Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-10620 State: PUBLISHED Published: 2020-04-16T10:46:05 Last Updated: 2024-08-04T22:31:59.958Z Vendors: Qualcomm, Inc. Products: Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile Problem Types: Buffer Copy Without Checking Size of Input in Display Description: Kernel memory error in debug module due to improper check of user data length before copying into memory in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in APQ8096AU, APQ8098, MSM8996AU, QCN7605, SDM439, SDX24, SM8150 Additional Analyst Notes: - CVE Pro
, Snapdragon Mobile in APQ8096AU, APQ8098, MSM8996AU, QCN7605, SDM439, SDX24, SM8150 Additional Analyst Notes: - CVE Program Container: References: - https://www.qualcomm.com/company/product-security/bulletins/april-2020-bulletin
CVE ID: CVE-2019-10621 State: PUBLISHED Published: 2020-04-16T10:46:05 Last Updated: 2024-08-04T22:31:59.762Z Vendors: Qualcomm, Inc. Products: Snapdragon Auto, Snapdragon Compute, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music Problem Types: Use After Free Issue in Neural Processing Unit Description: Use after free issue when MAP and UNMAP calls at same time as data structure used my MAP may be freed by UNMAP function in Snapdragon Auto, Snapdragon Compute, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in Nicobar, QCS405, Rennell, Saipan, SC8180X, SDX55, SM6150, SM7150, SM8150, SM8250, SXR2130 Additional Analyst Notes: - CVE Program Container
nnell, Saipan, SC8180X, SDX55, SM6150, SM7150, SM8150, SM8250, SXR2130 Additional Analyst Notes: - CVE Program Container: References: - https://www.qualcomm.com/company/product-security/bulletins/april-2020-bulletin
CVE ID: CVE-2019-10622 State: PUBLISHED Published: 2020-04-16T10:46:06 Last Updated: 2024-08-04T22:32:00.709Z Vendors: Qualcomm, Inc. Products: Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking Problem Types: Buffer Over-read issue in Audio Description: Out of bound memory access can happen while parsing ADSP message due to lack of check of size of payload received from userspace in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdrago
agon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8096AU, IPQ4019, IPQ6018, IPQ8064, IPQ8074, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, QCN7605, QCS605, SC8180X, SDM710, SDX24, SDX55, SM8150, SM8250, SXR2130 Additional Analyst Notes: - CVE Program Container: References: - https://www.qualcomm.com/company/product-security/bulletins/april-2020-bulletin
CVE ID: CVE-2019-10623 State: PUBLISHED Published: 2020-04-16T10:46:06 Last Updated: 2024-08-04T22:32:01.095Z Vendors: Qualcomm, Inc. Products: Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile Problem Types: Integer Overflow to Buffer Overflow in WLAN Host Description: Possible integer overflow can happen in host driver while processing user controlled string due to improper validation on data received. in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in QCN7605, QCS605, Rennell, SC81
cs Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in QCN7605, QCS605, Rennell, SC8180X, SDA845, SDM710, SDX24, SDX55, SM7150, SM8150, SM8250, SXR2130 Additional Analyst Notes: - CVE Program Container: References: - https://www.qualcomm.com/company/product-security/bulletins/april-2020-bulletin
CVE ID: CVE-2019-10624 State: PUBLISHED Published: 2020-04-16T10:46:07 Last Updated: 2024-08-04T22:31:59.927Z Vendors: Qualcomm, Inc. Products: Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile Problem Types: Integer Overflow to Buffer Overflow in WLAN Host Description: While handling the vendor command there is an integer truncation issue that could yield a buffer overflow due to int data type copied to u8 data type in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile in APQ8096AU, MSM8996AU, QCA6574AU, QCN7605, Rennell, SC8180X, SDM710,
ity, Snapdragon Industrial IOT, Snapdragon Mobile in APQ8096AU, MSM8996AU, QCA6574AU, QCN7605, Rennell, SC8180X, SDM710, SDX55, SM7150, SM8150, SM8250, SXR2130 Additional Analyst Notes: - CVE Program Container: References: - https://www.qualcomm.com/company/product-security/bulletins/april-2020-bulletin
CVE ID: CVE-2019-10625 State: PUBLISHED Published: 2020-04-16T10:46:07 Last Updated: 2024-08-04T22:32:00.696Z Vendors: Qualcomm, Inc. Products: Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables Problem Types: Buffer Over-read Issue in Diag Services Description: Out of bound access in diag services when DCI command buffer reallocation is not done properly with required capacity in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in APQ8009, APQ8096AU, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, QCS605, Rennell, SC8180X, SDM429W, SDM71
Wearables in APQ8009, APQ8096AU, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, QCS605, Rennell, SC8180X, SDM429W, SDM710, SDX55, SM7150, SM8150 Additional Analyst Notes: - CVE Program Container: References: - https://www.qualcomm.com/company/product-security/bulletins/april-2020-bulletin
CVE ID: CVE-2019-10626 State: PUBLISHED Published: 2020-06-22T07:10:34 Last Updated: 2024-08-04T22:32:00.963Z Vendors: Qualcomm, Inc. Products: Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking Problem Types: Information Exposure Issue inVideo Description: Payload size is not validated before reading memory that may cause issue of accessing invalid pointer or some garbage data in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music
Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8017, APQ8053, APQ8096AU, APQ8098, IPQ4019, IPQ6018, IPQ8064, IPQ8074, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Rennell, Saipan, SC8180X, SDA660, SDA845, SDM429W, SDM439, SDM670, SDM710, SDX20, SDX24, SDX55, SM8150, SM8250, SXR1130, SXR2130 Additional Analyst Notes: - CVE Program Container: References: - https://www.qualcomm.com/company/product-security/bulletins/june-2020-bulletin
CVE ID: CVE-2019-10627 State: PUBLISHED Published: 2019-11-21T14:38:22 Last Updated: 2024-08-04T22:31:59.930Z Vendors: Qualcomm, Inc. Products: PostScript and PDF printers that use IPS versions prior to 2019.2 Problem Types: Buffer overflow vulnerability in the PostScript- and PDF-compatible interpreters Description: Integer overflow to buffer overflow vulnerability in PostScript image handling code used by the PostScript- and PDF-compatible interpreters due to incorrect buffer size calculation. in PostScript and PDF printers that use IPS versions prior to 2019.2 in PostScript and PDF printers that use IPS versions prior to 2019.2 Additional Analyst Notes: - CVE Program Container: References
ipt and PDF printers that use IPS versions prior to 2019.2 Additional Analyst Notes: - CVE Program Container: References: - https://support.hp.com/us-en/document/c06458150 - https://www.qualcomm.com/company/product-security/bulletins/october-2019-bulletin
CVE ID: CVE-2019-10628 State: PUBLISHED Published: 2020-09-08T09:31:27 Last Updated: 2024-08-04T22:31:59.937Z Vendors: Qualcomm, Inc. Products: Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking Problem Types: Improper Validation of Array Index in Kernel Description: u'Memory can be potentially corrupted if random index is allowed to manipulate TLB entries in Kernel from user library' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity,
library' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in APQ8098, Bitra, MDM9205, MDM9650, MSM8998, Nicobar, QCA6390, QCN7605, QCS404, QCS405, QCS605, QCS610, Rennell, SA415M, SA6155P, Saipan, SC7180, SC8180X, SDA660, SDA845, SDM630, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130 Additional Analyst Notes: - CVE Program Container: References: - https://www.qualcomm.com/company/product-security/bulletins/august-2020-b
Notes: - CVE Program Container: References: - https://www.qualcomm.com/company/product-security/bulletins/august-2020-bulletin
CVE ID: CVE-2019-10629 State: PUBLISHED Published: 2020-09-08T09:31:27 Last Updated: 2024-08-04T22:32:00.874Z Vendors: Qualcomm, Inc. Products: Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking Problem Types: Improper Validation of Array Index in kernel Description: u'User Process can potentially corrupt kernel virtual page by passing a crafted page in API' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Sn
, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in Bitra, IPQ6018, IPQ8074, MDM9205, Nicobar, QCA8081, QCN7605, QCS404, QCS405, QCS605, QCS610, Rennell, SA415M, SA6155P, Saipan, SC7180, SC8180X, SDA845, SDM670, SDM710, SDM845, SDM850, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130 Additional Analyst Notes: - CVE Program Container: References: - https://www.qualcomm.com/company/product-security/bulletins/august-2020-bulletin
CVE ID: CVE-2019-10630 State: PUBLISHED Published: 2019-04-09T04:59:27 Last Updated: 2024-08-04T22:32:00.855Z Vendors: n/a Products: n/a Problem Types: n/a Description: A plaintext password vulnerability in the Zyxel NAS 326 through 5.21 allows an elevated privileged user to get the admin password of the device. Additional Analyst Notes: - CVE Program Container: References: - http://maxwelldulin.com/BlogPost?post=3236967424
CVE ID: CVE-2019-10631 State: PUBLISHED Published: 2019-04-09T04:59:43 Last Updated: 2024-08-04T22:31:59.943Z Vendors: n/a Products: n/a Problem Types: n/a Description: Shell Metacharacter Injection in the package installer on Zyxel NAS 326 version 5.21 and below allows an authenticated attacker to execute arbitrary code via multiple different requests. Additional Analyst Notes: - CVE Program Container: References: - http://maxwelldulin.com/BlogPost?post=3236967424
CVE ID: CVE-2019-10632 State: PUBLISHED Published: 2019-04-09T04:59:51 Last Updated: 2024-08-04T22:32:00.695Z Vendors: n/a Products: n/a Problem Types: n/a Description: A directory traversal vulnerability in the file browser component on the Zyxel NAS 326 version 5.21 and below allows a lower privileged user to change the location of any other user's files. Additional Analyst Notes: - CVE Program Container: References: - http://maxwelldulin.com/BlogPost?post=3236967424
CVE ID: CVE-2019-10633 State: PUBLISHED Published: 2019-04-09T05:00:10 Last Updated: 2024-08-04T22:32:01.264Z Vendors: n/a Products: n/a Problem Types: n/a Description: An eval injection vulnerability in the Python web server routing on the Zyxel NAS 326 version 5.21 and below allows a remote authenticated attacker to execute arbitrary code via the tjp6jp6y4, simZysh, and ck6fup6 APIs. Additional Analyst Notes: - CVE Program Container: References: - http://maxwelldulin.com/BlogPost?post=3236967424
CVE ID: CVE-2019-10634 State: PUBLISHED Published: 2019-04-09T05:00:20 Last Updated: 2024-08-04T22:31:59.918Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XSS vulnerability in the Zyxel NAS 326 version 5.21 and below allows a remote authenticated attacker to inject arbitrary JavaScript or HTML via the user, group, and file-share description fields. Additional Analyst Notes: - CVE Program Container: References: - http://maxwelldulin.com/BlogPost?post=3236967424
CVE ID: CVE-2019-10636 State: PUBLISHED Published: 2019-06-04T20:42:52 Last Updated: 2024-08-04T22:31:59.918Z Vendors: n/a Products: n/a Problem Types: n/a Description: Marvell SSD Controller (88SS1074, 88SS1079, 88SS1080, 88SS1093, 88SS1092, 88SS1095, 88SS9174, 88SS9175, 88SS9187, 88SS9188, 88SS9189, 88SS9190, 88SS1085, 88SS1087, 88SS1090, 88SS1100, 88SS1084, 88SS1088, & 88SS1098) devices allow reprogramming flash memory to bypass the secure boot protection mechanism. Additional Analyst Notes: - CVE Program Container: References: - https://www.marvell.com/documents/x9g4hrszt5ls3udbe1eo/
CVE ID: CVE-2019-10637 State: PUBLISHED Published: 2019-06-05T15:52:53 Last Updated: 2024-08-04T22:32:00.797Z Vendors: n/a Products: n/a Problem Types: n/a Description: Marvell SSD Controller (88SS1074, 88SS1079, 88SS1080, 88SS1093, 88SS1092, 88SS1095, 88SS9174, 88SS9175, 88SS9187, 88SS9188, 88SS9189, 88SS9190, 88SS1085, 88SS1087, 88SS1090, 88SS1100, 88SS1084, 88SS1088, & 88SS1098) devices are vulnerable in manipulating a combination of IO pins to bypass the secure boot protection mechanism. Additional Analyst Notes: - CVE Program Container: References: - https://www.marvell.com/documents/x9g4hrszt5ls3udbe1eo/
CVE ID: CVE-2019-10638 State: PUBLISHED Published: 2019-07-05T22:07:13 Last Updated: 2024-08-04T22:31:59.920Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Linux kernel before 5.1.7, a device can be tracked by an attacker using the IP ID values the kernel produces for connection-less protocols (e.g., UDP and ICMP). When such traffic is sent to multiple destination IP addresses, it is possible to obtain hash collisions (of indices to the counter array) and thereby obtain the hashing key (via enumeration). An attack may be conducted by hosting a crafted web page that uses WebRTC or gQUIC to force UDP traffic to attacker-controlled IP addresses. Additional Analyst Notes: - C
b page that uses WebRTC or gQUIC to force UDP traffic to attacker-controlled IP addresses. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/109092 - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00014.html - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00025.html - https://www.debian.org/security/2019/dsa-4495 - https://seclists.org/bugtraq/2019/Aug/13 - https://seclists.org/bugtraq/2019/Aug/18 - https://www.debian.org/security/2019/dsa-4497 - https://lists.debian.org/debian-lts-announce/2019/08/msg00016.html - https://lists.debian.org/debian-lts-announce/2019/08/msg00017.html - https://usn.ubuntu.com/4117-
019/08/msg00016.html - https://lists.debian.org/debian-lts-announce/2019/08/msg00017.html - https://usn.ubuntu.com/4117-1/ - https://usn.ubuntu.com/4114-1/ - https://usn.ubuntu.com/4115-1/ - https://usn.ubuntu.com/4116-1/ - https://usn.ubuntu.com/4118-1/ - https://access.redhat.com/errata/RHSA-2019:3309 - https://access.redhat.com/errata/RHSA-2019:3517 - https://seclists.org/bugtraq/2019/Nov/11 - https://www.oracle.com/security-alerts/cpuApr2021.html - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.0.8 - https://github.com/torvalds/linux/commit/355b98553789b646ed97ad801a619ff898471b92 - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=355b98553789b646ed97a
7ad801a619ff898471b92 - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=355b98553789b646ed97ad801a619ff898471b92 - https://arxiv.org/pdf/1906.10478.pdf - https://github.com/torvalds/linux/commit/55f0fc7a02de8f12757f4937143d8d5091b2e40b - https://github.com/torvalds/linux/commit/df453700e8d81b1bdafdf684365ee2b9431fb702 - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=df453700e8d81b1bdafdf684365ee2b9431fb702 - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.1.7 - https://security.netapp.com/advisory/ntap-20190806-0001/ - http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html
CVE ID: CVE-2019-10639 State: PUBLISHED Published: 2019-07-05T22:07:27 Last Updated: 2024-08-04T22:32:00.651Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Linux kernel 4.x (starting from 4.1) and 5.x before 5.0.8 allows Information Exposure (partial kernel address disclosure), leading to a KASLR bypass. Specifically, it is possible to extract the KASLR kernel image offset using the IP ID values the kernel produces for connection-less protocols (e.g., UDP and ICMP). When such traffic is sent to multiple destination IP addresses, it is possible to obtain hash collisions (of indices to the counter array) and thereby obtain the hashing key (via enumeration). This key contains e
h collisions (of indices to the counter array) and thereby obtain the hashing key (via enumeration). This key contains enough bits from a kernel address (of a static variable) so when the key is extracted (via enumeration), the offset of the kernel image is exposed. This attack can be carried out remotely, by the attacker forcing the target device to send UDP or ICMP (or certain other) traffic to attacker-controlled IP addresses. Forcing a server to send UDP traffic is trivial if the server is a DNS server. ICMP traffic is trivial if the server answers ICMP Echo requests (ping). For client targets, if the target visits the attacker's web page, then WebRTC or gQUIC can be used to force UDP tr
ing). For client targets, if the target visits the attacker's web page, then WebRTC or gQUIC can be used to force UDP traffic to attacker-controlled IP addresses. NOTE: this attack against KASLR became viable in 4.1 because IP ID generation was changed to have a dependency on an address associated with a network namespace. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00014.html - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00025.html - https://lists.debian.org/debian-lts-announce/2019/07/msg00022.html - https://seclists.org/bugtraq/2019/Aug/18 - https://www.debian.org/security/2019/dsa-449
announce/2019/07/msg00022.html - https://seclists.org/bugtraq/2019/Aug/18 - https://www.debian.org/security/2019/dsa-4497 - https://lists.debian.org/debian-lts-announce/2019/08/msg00017.html - https://usn.ubuntu.com/4115-1/ - https://usn.ubuntu.com/4118-1/ - https://www.oracle.com/security-alerts/cpuApr2021.html - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.0.8 - https://github.com/torvalds/linux/commit/355b98553789b646ed97ad801a619ff898471b92 - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=355b98553789b646ed97ad801a619ff898471b92 - https://arxiv.org/pdf/1906.10478.pdf - https://security.netapp.com/advisory/ntap-20190806-0001/ - https://support.f5.co
https://arxiv.org/pdf/1906.10478.pdf - https://security.netapp.com/advisory/ntap-20190806-0001/ - https://support.f5.com/csp/article/K32804955 - https://support.f5.com/csp/article/K32804955?utm_source=f5support&amp%3Butm_medium=RSS
CVE ID: CVE-2019-10640 State: PUBLISHED Published: 2019-05-15T18:58:17 Last Updated: 2024-08-04T22:31:59.943Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.7.10, 11.8.x before 11.8.6, and 11.9.x before 11.9.4. A regex input validation issue for the .gitlab-ci.yml refs value allows Uncontrolled Resource Consumption. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/blog/categories/releases/ - https://about.gitlab.com/2019/04/01/security-release-gitlab-11-dot-9-dot-4-released/ - https://gitlab.com/gitlab-org/gitlab-ce/issues/49665
CVE ID: CVE-2019-10641 State: PUBLISHED Published: 2019-04-17T18:46:39 Last Updated: 2024-08-04T22:32:00.987Z Vendors: n/a Products: n/a Problem Types: n/a Description: Contao before 3.5.39 and 4.x before 4.7.3 has a Weak Password Recovery Mechanism for a Forgotten Password. Additional Analyst Notes: - CVE Program Container: References: - https://contao.org/en/news.html - https://contao.org/en/news/security-vulnerability-cve-2019-10641.html
CVE ID: CVE-2019-10642 State: PUBLISHED Published: 2019-04-17T18:54:30 Last Updated: 2024-08-04T22:31:59.937Z Vendors: n/a Products: n/a Problem Types: n/a Description: Contao 4.7 allows CSRF. Additional Analyst Notes: - CVE Program Container: References: - https://contao.org/en/news.html - https://contao.org/en/news/security-vulnerability-cve-2019-10642.html
CVE ID: CVE-2019-10643 State: PUBLISHED Published: 2019-04-17T18:50:52 Last Updated: 2024-08-04T22:32:01.293Z Vendors: n/a Products: n/a Problem Types: n/a Description: Contao 4.7 allows Use of a Key Past its Expiration Date. Additional Analyst Notes: - CVE Program Container: References: - https://contao.org/en/news.html - https://contao.org/en/news/security-vulnerability-cve-2019-10643.html
CVE ID: CVE-2019-10644 State: PUBLISHED Published: 2019-03-30T02:13:07 Last Updated: 2024-08-04T22:32:00.731Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in HYBBS 2.2. /?admin/user.html has a CSRF vulnerability that can add an administrator account. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hyyyp/HYBBS2/issues/3
CVE ID: CVE-2019-10646 State: PUBLISHED Published: 2019-03-30T02:30:10 Last Updated: 2024-08-04T22:32:00.637Z Vendors: n/a Products: n/a Problem Types: n/a Description: Wolf CMS v0.8.3.1 is affected by cross site scripting (XSS) in the module Add Snippet (/?/admin/snippet/add). This allows an attacker to insert arbitrary JavaScript as user input, which will be executed whenever the affected snippet is loaded. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wolfcms/wolfcms/issues/682
CVE ID: CVE-2019-10647 State: PUBLISHED Published: 2019-03-30T12:30:59 Last Updated: 2024-08-04T22:32:00.646Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZZZCMS zzzphp v1.6.3 allows remote attackers to execute arbitrary PHP code via a .php URL in the plugins/ueditor/php/controller.php?action=catchimage source[] parameter because of a lack of inc/zzz_file.php restrictions. For example, source%5B%5D=http%3A%2F%2F192.168.0.1%2Ftest.php can be used if the 192.168.0.1 web server sends the contents of a .php file (i.e., it does not interpret a .php file). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kyrie403/Vuln/blob/master/zzzcms/zzzphp%20v1.
l Analyst Notes: - CVE Program Container: References: - https://github.com/kyrie403/Vuln/blob/master/zzzcms/zzzphp%20v1.6.3%20write%20file%20with%20dangerous%20type.md