Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-7616 State: PUBLISHED Published: 2019-07-30T21:15:47 Last Updated: 2024-08-04T20:54:28.470Z Vendors: Elastic Products: Kibana Problem Types: CWE-918 Description: Kibana versions before 6.8.2 and 7.2.1 contain a server side request forgery (SSRF) flaw in the graphite integration for Timelion visualizer. An attacker with administrative Kibana access could set the timelion:graphite.url configuration option to an arbitrary URL. This could possibly lead to an attacker accessing external URL resources as the Kibana process on the host system. Additional Analyst Notes: - CVE Program Container: References: - https://www.elastic.co/community/security/
CVE ID: CVE-2019-7617 State: PUBLISHED Published: 2019-08-22T16:12:10 Last Updated: 2024-08-04T20:54:28.320Z Vendors: Elastic Products: Elastic APM agent for Python Problem Types: CWE-20 Description: When the Elastic APM agent for Python versions before 5.1.0 is run as a CGI script, there is a variable name clash flaw if a remote attacker can control the proxy header. This could result in an attacker redirecting collected APM data to a proxy of their choosing. Additional Analyst Notes: - CVE Program Container: References: - https://www.elastic.co/community/security/ - https://discuss.elastic.co/t/elastic-apm-agent-for-python-5-1-0-security-update/196145
CVE ID: CVE-2019-7618 State: PUBLISHED Published: 2019-10-01T17:52:42 Last Updated: 2024-08-04T20:54:28.312Z Vendors: Elastic Products: Elastic Code Problem Types: CWE-538 Description: A local file disclosure flaw was found in Elastic Code versions 7.3.0, 7.3.1, and 7.3.2. If a malicious code repository is imported into Code it is possible to read arbitrary files from the local filesystem of the Kibana instance running Code with the permission of the Kibana system user. Additional Analyst Notes: - CVE Program Container: References: - https://staging-website.elastic.co/community/security - https://discuss.elastic.co/t/elastic-stack-7-4-0-security-update/201831
CVE ID: CVE-2019-7619 State: PUBLISHED Published: 2019-10-30T13:37:42 Last Updated: 2024-08-04T20:54:28.459Z Vendors: Elastic Products: Elasticsearch Problem Types: CWE-200 Description: Elasticsearch versions 7.0.0-7.3.2 and 6.7.0-6.8.3 contain a username disclosure flaw was found in the API Key service. An unauthenticated attacker could send a specially crafted request and determine if a username exists in the Elasticsearch native realm. Additional Analyst Notes: - CVE Program Container: References: - https://www.elastic.co/community/security - https://discuss.elastic.co/t/elastic-stack-6-8-4-security-update/204908 - https://discuss.elastic.co/t/elastic-stack-7-4-0-security-update/201831
CVE ID: CVE-2019-7620 State: PUBLISHED Published: 2019-10-30T13:38:40 Last Updated: 2024-08-04T20:54:28.357Z Vendors: Elastic Products: Logstash Problem Types: CWE-400 Description: Logstash versions before 7.4.1 and 6.8.4 contain a denial of service flaw in the Logstash Beats input plugin. An unauthenticated user who is able to connect to the port the Logstash beats input could send a specially crafted network packet that would cause Logstash to stop responding. Additional Analyst Notes: - CVE Program Container: References: - https://www.elastic.co/community/security - https://discuss.elastic.co/t/elastic-stack-6-8-4-security-update/204908 - https://discuss.elastic.co/t/elastic-stack-7-4-1-s
s://discuss.elastic.co/t/elastic-stack-6-8-4-security-update/204908 - https://discuss.elastic.co/t/elastic-stack-7-4-1-security-update/204909
CVE ID: CVE-2019-7621 State: PUBLISHED Published: 2019-12-18T19:50:12 Last Updated: 2024-08-04T20:54:28.434Z Vendors: Elastic Products: Kibana Problem Types: CWE-79 Description: Kibana versions before 6.8.6 and 7.5.1 contain a cross site scripting (XSS) flaw in the coordinate and region map visualizations. An attacker with the ability to create coordinate map visualizations could create a malicious visualization. If another Kibana user views that visualization or a dashboard containing the visualization it could execute JavaScript in the victimï¿½s browser. Additional Analyst Notes: - CVE Program Container: References: - https://www.elastic.co/community/security/ - https://discuss.elastic.co
st Notes: - CVE Program Container: References: - https://www.elastic.co/community/security/ - https://discuss.elastic.co/t/elastic-stack-6-8-6-and-7-5-1-security-update/212390
CVE ID: CVE-2019-7628 State: PUBLISHED Published: 2019-02-08T03:00:00 Last Updated: 2024-08-04T20:54:27.895Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pagure 5.2 leaks API keys by e-mailing them to users. Few e-mail servers validate TLS certificates, so it is easy for man-in-the-middle attackers to read these e-mails and gain access to Pagure on behalf of other users. This issue is found in the API token expiration reminder cron job in files/api_key_expire_mail.py; disabling that job is also a viable solution. (E-mailing a substring of the API key was an attempted, but rejected, solution.) Additional Analyst Notes: - CVE Program Container: References: - https://pagure.io/pag
tempted, but rejected, solution.) Additional Analyst Notes: - CVE Program Container: References: - https://pagure.io/pagure/c/9905fb1e64341822366b6ab1d414d2baa230af0a - https://pagure.io/pagure/pull-request/4254 - https://pagure.io/pagure/issue/4230 - https://pagure.io/pagure/issue/4252 - https://pagure.io/pagure/issue/4253
CVE ID: CVE-2019-7629 State: PUBLISHED Published: 2019-02-18T20:00:00 Last Updated: 2024-08-04T20:54:27.833Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in the strip_vt102_codes function in TinTin++ 2.01.6 and WinTin++ 2.01.6 allows remote attackers to execute arbitrary code by sending a long message to the client. Additional Analyst Notes: - CVE Program Container: References: - https://tintin.sourceforge.io/forum/viewtopic.php?f=1&t=2584&sid=31b77bb001faea9269bf224280960e29#p10505 - https://tintin.sourceforge.io/news.php - https://trustfoundry.net/cve-2019-7629-rce-in-an-open-source-mud-client/
CVE ID: CVE-2019-7630 State: PUBLISHED Published: 2020-03-25T16:59:12 Last Updated: 2024-08-04T20:54:28.409Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in gdrv.sys in Gigabyte APP Center before 19.0227.1. The vulnerable driver exposes a wrmsr instruction via IOCTL 0xC3502580 and does not properly filter the target Model Specific Register (MSR). Allowing arbitrary MSR writes can lead to Ring-0 code execution and escalation of privileges. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fireeye/Vulnerability-Disclosures/blob/master/FEYE-2019-0003/FEYE-2019-0003.md - https://www.gigabyte.com/Support/Security/1801
CVE ID: CVE-2019-7632 State: PUBLISHED Published: 2019-02-08T05:00:00Z Last Updated: 2024-09-16T20:31:17.300Z Vendors: n/a Products: n/a Problem Types: n/a Description: LifeSize Team, Room, Passport, and Networker 220 devices allow Authenticated Remote OS Command Injection, as demonstrated by shell metacharacters in the support/mtusize.php mtu_size parameter. The lifesize default password for the cli account may sometimes be used for authentication. Additional Analyst Notes: - CVE Program Container: References: - https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=22113
CVE ID: CVE-2019-7634 State: PUBLISHED Published: 2020-04-29T12:59:54 Last Updated: 2024-08-04T20:54:28.387Z Vendors: n/a Products: n/a Problem Types: n/a Description: SUAP V2 allows XSS during the update of user information. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40crhenr/cve-2019-7634-my-first-cve-61db875dc94a
CVE ID: CVE-2019-7635 State: PUBLISHED Published: 2019-02-08T00:00:00 Last Updated: 2024-08-04T20:54:28.411Z Vendors: n/a Products: n/a Problem Types: n/a Description: SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2019/03/msg00016.html - https://bugzilla.libsdl.org/show_bug.cgi?id=4498 - https://lists.debian.org/debian-lts-announce/2019/03/msg00015.html - https://discourse.libsdl.org/t/vulnerabilities-found-in-libsdl-1-2-15/25720 - http://lists.opensuse.org/opensuse-security-announce/2019-04/ms
sdl.org/t/vulnerabilities-found-in-libsdl-1-2-15/25720 - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00063.html - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00073.html - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00088.html - https://lists.debian.org/debian-lts-announce/2019/07/msg00021.html - https://lists.debian.org/debian-lts-announce/2019/07/msg00026.html - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00014.html - https://security.gentoo.org/glsa/201909-07 - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00030.html - https://usn.ubuntu.com/4143-1/ - https://usn.ubuntu.com/4156-1/ - https://u
se-security-announce/2019-09/msg00030.html - https://usn.ubuntu.com/4143-1/ - https://usn.ubuntu.com/4156-1/ - https://usn.ubuntu.com/4156-2/ - https://lists.debian.org/debian-lts-announce/2019/10/msg00021.html - https://lists.debian.org/debian-lts-announce/2019/10/msg00020.html - https://usn.ubuntu.com/4238-1/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7ZO47LLKKRXKMUGSRCFNHSTHG5OEBYCG/ - https://lists.debian.org/debian-lts-announce/2021/01/msg00024.html - https://lists.debian.org/debian-lts-announce/2021/10/msg00032.html - https://lists.debian.org/debian-lts-announce/2023/02/msg00008.html - https://security.gentoo.org/glsa/202305-17
CVE ID: CVE-2019-7636 State: PUBLISHED Published: 2019-02-08T00:00:00 Last Updated: 2024-08-04T20:54:27.838Z Vendors: n/a Products: n/a Problem Types: n/a Description: SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in SDL_GetRGB in video/SDL_pixels.c. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2019/03/msg00016.html - https://lists.debian.org/debian-lts-announce/2019/03/msg00015.html - https://bugzilla.libsdl.org/show_bug.cgi?id=4499 - https://discourse.libsdl.org/t/vulnerabilities-found-in-libsdl-1-2-15/25720 - http://lists.opensuse.org/opensuse-security-announce/2019-04/
ibsdl.org/t/vulnerabilities-found-in-libsdl-1-2-15/25720 - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00063.html - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00073.html - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00088.html - https://security.gentoo.org/glsa/201909-07 - https://usn.ubuntu.com/4143-1/ - https://usn.ubuntu.com/4156-1/ - https://usn.ubuntu.com/4156-2/ - https://lists.debian.org/debian-lts-announce/2019/10/msg00021.html - https://lists.debian.org/debian-lts-announce/2019/10/msg00020.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7ZO47LLKKRXKMUGSRCFNHSTHG5OEBYC
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7ZO47LLKKRXKMUGSRCFNHSTHG5OEBYCG/ - https://lists.debian.org/debian-lts-announce/2021/01/msg00024.html - https://lists.debian.org/debian-lts-announce/2021/10/msg00032.html - https://lists.debian.org/debian-lts-announce/2023/02/msg00008.html - https://security.gentoo.org/glsa/202305-17
CVE ID: CVE-2019-7637 State: PUBLISHED Published: 2019-02-08T11:00:00 Last Updated: 2024-08-04T20:54:28.461Z Vendors: n/a Products: n/a Problem Types: n/a Description: SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer overflow in SDL_FillRect in video/SDL_surface.c. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2019/03/msg00016.html - https://lists.debian.org/debian-lts-announce/2019/03/msg00015.html - https://bugzilla.libsdl.org/show_bug.cgi?id=4497 - https://discourse.libsdl.org/t/vulnerabilities-found-in-libsdl-1-2-15/25720 - http://lists.opensuse.org/opensuse-security-announce/2019-0
.libsdl.org/t/vulnerabilities-found-in-libsdl-1-2-15/25720 - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00063.html - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00073.html - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00088.html - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00081.html - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00071.html - https://usn.ubuntu.com/4143-1/ - https://usn.ubuntu.com/4156-1/ - https://usn.ubuntu.com/4156-2/ - https://lists.debian.org/debian-lts-announce/2019/10/msg00021.html - https://lists.debian.org/debian-lts-announce/2019/10/msg00020.html - https://lists.fed
-announce/2019/10/msg00021.html - https://lists.debian.org/debian-lts-announce/2019/10/msg00020.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7ZO47LLKKRXKMUGSRCFNHSTHG5OEBYCG/ - https://lists.debian.org/debian-lts-announce/2021/10/msg00031.html - https://lists.debian.org/debian-lts-announce/2021/10/msg00032.html
CVE ID: CVE-2019-7638 State: PUBLISHED Published: 2019-02-08T00:00:00 Last Updated: 2024-08-04T20:54:28.222Z Vendors: n/a Products: n/a Problem Types: n/a Description: SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in Map1toN in video/SDL_pixels.c. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2019/03/msg00016.html - https://lists.debian.org/debian-lts-announce/2019/03/msg00015.html - https://discourse.libsdl.org/t/vulnerabilities-found-in-libsdl-1-2-15/25720 - https://bugzilla.libsdl.org/show_bug.cgi?id=4500 - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg
20 - https://bugzilla.libsdl.org/show_bug.cgi?id=4500 - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00063.html - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00073.html - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00088.html - https://security.gentoo.org/glsa/201909-07 - https://usn.ubuntu.com/4143-1/ - https://usn.ubuntu.com/4156-1/ - https://lists.debian.org/debian-lts-announce/2019/10/msg00021.html - https://lists.debian.org/debian-lts-announce/2019/10/msg00020.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7ZO47LLKKRXKMUGSRCFNHSTHG5OEBYCG/ - https://lists.debian.org/debian
t/package-announce%40lists.fedoraproject.org/message/7ZO47LLKKRXKMUGSRCFNHSTHG5OEBYCG/ - https://lists.debian.org/debian-lts-announce/2021/01/msg00024.html - https://lists.debian.org/debian-lts-announce/2021/10/msg00032.html - https://lists.debian.org/debian-lts-announce/2023/02/msg00008.html - https://security.gentoo.org/glsa/202305-17
CVE ID: CVE-2019-7639 State: PUBLISHED Published: 2019-02-08T11:00:00Z Last Updated: 2024-09-17T00:51:16.806Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in gsi-openssh-server 7.9p1 on Fedora 29. If PermitPAMUserChange is set to yes in the /etc/gsissh/sshd_config file, logins succeed with a valid username and an incorrect password, even though a failure entry is recorded in the /var/log/messages file. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1673802
CVE ID: CVE-2019-7642 State: PUBLISHED Published: 2019-03-25T21:29:04 Last Updated: 2024-08-04T20:54:27.952Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link routers with the mydlink feature have some web interfaces without authentication requirements. An attacker can remotely obtain users' DNS query logs and login logs. Vulnerable targets include but are not limited to the latest firmware versions of DIR-817LW (A1-1.04), DIR-816L (B1-2.06), DIR-816 (B1-2.06?), DIR-850L (A1-1.09), and DIR-868L (A1-1.10). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/xw77cve/CVE-2019-7642/blob/master/README.md
CVE ID: CVE-2019-7644 State: PUBLISHED Published: 2019-04-11T19:44:18 Last Updated: 2024-08-04T20:54:28.292Z Vendors: n/a Products: n/a Problem Types: n/a Description: Auth0 Auth0-WCF-Service-JWT before 1.0.4 leaks the expected JWT signature in an error message when it cannot successfully validate the JWT signature. If this error message is presented to an attacker, they can forge an arbitrary JWT token that will be accepted by the vulnerable application. Additional Analyst Notes: - CVE Program Container: References: - https://auth0.com/docs/security/bulletins/cve-2019-7644
CVE ID: CVE-2019-7646 State: PUBLISHED Published: 2019-03-26T15:02:01 Last Updated: 2024-08-04T20:54:28.408Z Vendors: n/a Products: n/a Problem Types: n/a Description: CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.763 is vulnerable to Stored/Persistent XSS for the "Package Name" field via the add_package module parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/151630/CentOS-Web-Panel-0.9.8.763-Cross-Site-Scripting.html - https://www.exploit-db.com/exploits/46349/ - https://www.dineshmohanty.com/centos-web-panel-xss
CVE ID: CVE-2019-7648 State: PUBLISHED Published: 2019-02-08T17:00:00 Last Updated: 2024-08-04T20:54:27.851Z Vendors: n/a Products: n/a Problem Types: n/a Description: controller/fetchpwd.php and controller/doAction.php in Hotels_Server through 2018-11-05 rely on base64 in an attempt to protect password storage. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FantasticLBP/Hotels_Server/issues/2
CVE ID: CVE-2019-7649 State: PUBLISHED Published: 2019-02-17T21:00:00 Last Updated: 2024-08-04T20:54:28.333Z Vendors: n/a Products: n/a Problem Types: n/a Description: global.encryptPassword in bootstrap/global.js in CMSWing 1.3.7 relies on multiple MD5 operations for password hashing. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/arterli/CmsWing/issues/41
CVE ID: CVE-2019-7651 State: PUBLISHED Published: 2019-02-08T22:00:00 Last Updated: 2024-08-04T20:54:28.303Z Vendors: n/a Products: n/a Problem Types: n/a Description: EPP.sys in Emsisoft Anti-Malware prior to version 2018.12 allows an attacker to bypass ACLs because Interpreted Device Characteristics lacks FILE_DEVICE_SECURE_OPEN and therefore files and directories "inside" the \\.\EPP device are not properly protected, leading to unintended impersonation or object creation. This vulnerability has been fixed in version 2018.12 and later. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nafiez/nafiez.github.io/blob/master/_posts/2019-01-09-emsisoft-Anti-Mal
gram Container: References: - https://github.com/nafiez/nafiez.github.io/blob/master/_posts/2019-01-09-emsisoft-Anti-Malware-bypass.md - https://nafiez.github.io/security/bypass/2019/01/08/emsisoft-Anti-Malware-bypass.html - https://blog.emsisoft.com/en/32517/new-in-2018-12-safe-web-browsing-with-emsisoft-browser-security/ - https://help.emsisoft.com/en/1760/vulnerability-report-en/
CVE ID: CVE-2019-7652 State: PUBLISHED Published: 2019-05-09T20:48:57 Last Updated: 2024-08-04T20:54:28.315Z Vendors: n/a Products: n/a Problem Types: n/a Description: TheHive Project UnshortenLink analyzer before 1.1, included in Cortex-Analyzers before 1.15.2, has SSRF. To exploit the vulnerability, an attacker must create a new analysis, select URL for Data Type, and provide an SSRF payload like "http://127.0.0.1:22" in the Data parameter. The result can be seen in the main dashboard. Thus, it is possible to do port scans on localhost and intranet hosts. Additional Analyst Notes: - CVE Program Container: References: - https://blog.thehive-project.org/2019/02/11/unshortenlink-ssrf-and-cort
st Notes: - CVE Program Container: References: - https://blog.thehive-project.org/2019/02/11/unshortenlink-ssrf-and-cortex-analyzers-1-15-2/ - http://packetstormsecurity.com/files/152804/TheHive-Project-Cortex-2.1.3-Server-Side-Request-Forgery.html
CVE ID: CVE-2019-7653 State: PUBLISHED Published: 2019-02-09T03:00:00 Last Updated: 2024-08-04T20:54:28.350Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Debian python-rdflib-tools 4.2.2-1 package for RDFLib 4.2.2 has CLI tools that can load Python modules from the current working directory, allowing code injection, because "python -m" looks in this directory, as demonstrated by rdf2dot. This issue is specific to use of the debian/scripts directory. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.debian.org/921751 - https://lists.debian.org/debian-lts-announce/2019/03/msg00019.html - https://usn.ubuntu.com/4535-1/ - https://lists.debian.org/deb
sts.debian.org/debian-lts-announce/2019/03/msg00019.html - https://usn.ubuntu.com/4535-1/ - https://lists.debian.org/debian-lts-announce/2021/12/msg00026.html
CVE ID: CVE-2019-7654 State: PUBLISHED Published: 2020-01-29T15:18:25 Last Updated: 2024-08-04T20:54:28.395Z Vendors: n/a Products: n/a Problem Types: n/a Description: Wowza Streaming Engine 4.8.0 and earlier suffers from multiple CSRF vulnerabilities. For example, an administrator, by following a link, can be tricked into making unwanted changes such as adding another admin user via enginemanager/server/user/edit.htm in the Server->Users component. This issue was resolved in Wowza Streaming Engine 4.8.5. Additional Analyst Notes: - CVE Program Container: References: - https://www.wowza.com/pricing/installer - https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-7654-CSRF-Wowza
s://www.wowza.com/pricing/installer - https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-7654-CSRF-Wowza - https://www.wowza.com/docs/wowza-streaming-engine-4-8-5-release-notes - https://raw.githubusercontent.com/WowzaMediaSystems/public_cve/main/wowza-streaming-engine/CVE-2019-7654.txt
CVE ID: CVE-2019-7655 State: PUBLISHED Published: 2020-01-29T15:25:24 Last Updated: 2024-08-04T20:54:28.468Z Vendors: n/a Products: n/a Problem Types: n/a Description: Wowza Streaming Engine 4.8.0 and earlier from multiple authenticated XSS vulnerabilities via the (1) customList%5B0%5D.value field in enginemanager/server/serversetup/edit_adv.htm of the Server Setup configuration or the (2) host field in enginemanager/j_spring_security_check of the login form. This issue was resolved in Wowza Streaming Engine 4.8.5. Additional Analyst Notes: - CVE Program Container: References: - https://www.wowza.com/pricing/installer - https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-7655-X
es: - https://www.wowza.com/pricing/installer - https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-7655-XSS-Wowza - https://www.wowza.com/docs/wowza-streaming-engine-4-8-5-release-notes - https://raw.githubusercontent.com/WowzaMediaSystems/public_cve/main/wowza-streaming-engine/CVE-2019-7655.txt
CVE ID: CVE-2019-7656 State: PUBLISHED Published: 2020-01-29T15:21:50 Last Updated: 2024-08-04T20:54:28.335Z Vendors: n/a Products: n/a Problem Types: n/a Description: A privilege escalation vulnerability in Wowza Streaming Engine 4.8.0 and earlier allows any unprivileged Linux user to escalate privileges to root. The installer sets too relaxed permissions on /usr/local/WowzaStreamingEngine/bin/* core program files. By injecting a payload into one of those files, it will run with the same privileges as the Wowza server, root. For example, /usr/local/WowzaStreamingEngine/bin/tune.sh could be replaced with a Trojan horse. This issue was resolved in Wowza Streaming Engine 4.8.5. Additional Anal
/tune.sh could be replaced with a Trojan horse. This issue was resolved in Wowza Streaming Engine 4.8.5. Additional Analyst Notes: - CVE Program Container: References: - https://www.wowza.com/pricing/installer - https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-7656-PrivEscal-Wowza - https://www.wowza.com/docs/wowza-streaming-engine-4-8-5-release-notes - https://raw.githubusercontent.com/WowzaMediaSystems/public_cve/main/wowza-streaming-engine/CVE-2019-7656.txt