Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-13603 State: PUBLISHED Published: 2019-07-16T16:52:31 Last Updated: 2024-08-04T23:57:39.463Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the HID Global DigitalPersona (formerly Crossmatch) U.are.U 4500 Fingerprint Reader Windows Biometric Framework driver 5.0.0.5. It has a statically coded initialization vector to encrypt a user's fingerprint image, resulting in weak encryption of that. This, in combination with retrieving an encrypted fingerprint image and encryption key (through another vulnerability), allows an attacker to obtain a user's fingerprint image. Additional Analyst Notes: - CVE Program Container: References: - https://g
ttacker to obtain a user's fingerprint image. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sungjungk/fp-scanner-hacking - https://www.youtube.com/watch?v=wEXJDyEOatM - https://www.youtube.com/watch?v=Grirez2xeas
CVE ID: CVE-2019-13604 State: PUBLISHED Published: 2019-07-15T13:47:12 Last Updated: 2024-08-04T23:57:39.456Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a short key vulnerability in HID Global DigitalPersona (formerly Crossmatch) U.are.U 4500 Fingerprint Reader v24. The key for obfuscating the fingerprint image is vulnerable to brute-force attacks. This allows an attacker to recover the key and decrypt that image using the key. Successful exploitation causes a sensitive biometric information leak. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sungjungk/fp-img-key-crack - https://www.youtube.com/watch?v=BwYK_xZlKi4 - https://www.y
eferences: - https://github.com/sungjungk/fp-img-key-crack - https://www.youtube.com/watch?v=BwYK_xZlKi4 - https://www.youtube.com/watch?v=7tKJQdKRm2k
CVE ID: CVE-2019-13605 State: PUBLISHED Published: 2019-07-16T16:46:07 Last Updated: 2024-08-04T23:57:39.522Z Vendors: n/a Products: n/a Problem Types: n/a Description: In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.838 to 0.9.8.846, remote attackers can bypass authentication in the login process by leveraging the knowledge of a valid username. The attacker must defeat an encoding that is not equivalent to base64, and thus this is different from CVE-2019-13360. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/47123 - https://github.com/i3umi3iei3ii/CentOS-Control-Web-Panel-CVE/blob/master/CVE-2019-13605.md - http://packetstormsecur
3 - https://github.com/i3umi3iei3ii/CentOS-Control-Web-Panel-CVE/blob/master/CVE-2019-13605.md - http://packetstormsecurity.com/files/153665/CentOS-Control-Web-Panel-0.9.8.836-Authentication-Bypass.html
CVE ID: CVE-2019-13607 State: PUBLISHED Published: 2019-07-18T14:42:59 Last Updated: 2024-08-04T23:57:39.532Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Opera Mini application through 16.0.14 for iOS has a UXSS vulnerability that can be triggered by performing navigation to a javascript: URL. Additional Analyst Notes: - CVE Program Container: References: - https://blog.rakeshmane.com/2019/07/u-xss-in-operamini-for-ios-browser-0-day.html
CVE ID: CVE-2019-13608 State: PUBLISHED Published: 2019-08-29T18:33:18.000Z Last Updated: 2025-10-21T23:45:31.593Z Vendors: n/a Products: n/a Problem Types: n/a Description: Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000) allows XXE attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.citrix.com/article/CTX251988
CVE ID: CVE-2019-13611 State: PUBLISHED Published: 2019-07-15T23:17:14 Last Updated: 2024-08-04T23:57:39.515Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in python-engineio through 3.8.2. There is a Cross-Site WebSocket Hijacking (CSWSH) vulnerability that allows attackers to make WebSocket connections to a server by using a victim's credentials, because the Origin header is not restricted. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/miguelgrinberg/python-engineio/issues/128
CVE ID: CVE-2019-13612 State: PUBLISHED Published: 2019-07-16T12:24:48 Last Updated: 2024-08-04T23:57:39.468Z Vendors: n/a Products: n/a Problem Types: n/a Description: MDaemon Email Server 19 through 20.0.1 skips SpamAssassin checks by default for e-mail messages larger than 2 MB (and limits checks to 10 MB even with special configuration), which is arguably inconsistent with currently popular message sizes. This might interfere with risk management for malicious e-mail, if a customer deploys a server with sufficient resources to scan large messages. Additional Analyst Notes: - CVE Program Container: References: - http://lists.altn.com/WebX/.59862f3c
CVE ID: CVE-2019-13613 State: PUBLISHED Published: 2019-07-17T16:58:51 Last Updated: 2024-08-04T23:57:39.481Z Vendors: n/a Products: n/a Problem Types: n/a Description: CMD_FTEST_CONFIG in the TP-Link Device Debug protocol in TP-Link Wireless Router Archer Router version 1.0.0 Build 20180502 rel.45702 (EU) and earlier is prone to a stack-based buffer overflow, which allows a remote attacker to achieve code execution or denial of service by sending a crafted payload to the listening server. Additional Analyst Notes: - CVE Program Container: References: - https://fakhrizulkifli.github.io/posts/2019/07/15/CVE-2019-13613/
CVE ID: CVE-2019-13614 State: PUBLISHED Published: 2019-07-17T17:06:21 Last Updated: 2024-08-04T23:57:39.532Z Vendors: n/a Products: n/a Problem Types: n/a Description: CMD_SET_CONFIG_COUNTRY in the TP-Link Device Debug protocol in TP-Link Archer C1200 1.0.0 Build 20180502 rel.45702 and earlier is prone to a stack-based buffer overflow, which allows a remote attacker to achieve code execution or denial of service by sending a crafted payload to the listening server. Additional Analyst Notes: - CVE Program Container: References: - https://fakhrizulkifli.github.io/posts/2019/07/15/CVE-2019-13614/
CVE ID: CVE-2019-13615 State: PUBLISHED Published: 2019-07-16T16:06:34 Last Updated: 2024-08-04T23:57:39.469Z Vendors: n/a Products: n/a Problem Types: n/a Description: libebml before 1.3.6, as used in the MKV module in VideoLAN VLC Media Player binaries before 3.0.3, has a heap-based buffer over-read in EbmlElement::FindNextElement. Additional Analyst Notes: - CVE Program Container: References: - https://trac.videolan.org/vlc/ticket/22474 - http://www.securityfocus.com/bid/109304 - https://github.com/Matroska-Org/libebml/commit/05beb69ba60acce09f73ed491bb76f332849c3a0 - https://github.com/Matroska-Org/libebml/compare/release-1.3.5...release-1.3.6 - https://usn.ubuntu.com/4073-1/ - https://g
tps://github.com/Matroska-Org/libebml/compare/release-1.3.5...release-1.3.6 - https://usn.ubuntu.com/4073-1/ - https://github.com/Matroska-Org/libebml/commit/b66ca475be967547af9a3784e720fbbacd381be6
CVE ID: CVE-2019-13616 State: PUBLISHED Published: 2019-07-16T00:00:00 Last Updated: 2024-08-04T23:57:39.517Z Vendors: n/a Products: n/a Problem Types: n/a Description: SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in BlitNtoN in video/SDL_blit_N.c when called from SDL_SoftBlit in video/SDL_blit.c. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.libsdl.org/show_bug.cgi?id=4538 - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00012.html - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00014.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fed
use-security-announce/2019-09/msg00014.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HEH5RO7XZA5DDCO2XOP4QHDEELQQTYV2/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UITVW4WTOOCECLLWPQCV7VWMU66DN255/ - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00030.html - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00029.html - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00093.html - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00094.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
curity-announce/2019-09/msg00094.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VDNX3RVXTWELBXQDNERNVVKDGKDF2MPB/ - https://usn.ubuntu.com/4156-1/ - https://usn.ubuntu.com/4156-2/ - https://access.redhat.com/errata/RHSA-2019:3951 - https://access.redhat.com/errata/RHSA-2019:3950 - https://usn.ubuntu.com/4238-1/ - https://access.redhat.com/errata/RHSA-2020:0293 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GY6FDFPYUJ7YPY3XB5U75VJHBSVRVIKO/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7ZO47LLKKRXKMUGSRCFNHSTHG5OEBYCG/ - https://list
ct.org/archives/list/package-announce%40lists.fedoraproject.org/message/7ZO47LLKKRXKMUGSRCFNHSTHG5OEBYCG/ - https://lists.debian.org/debian-lts-announce/2021/01/msg00024.html - https://lists.debian.org/debian-lts-announce/2021/10/msg00032.html - https://lists.debian.org/debian-lts-announce/2023/02/msg00008.html - https://security.gentoo.org/glsa/202305-17
CVE ID: CVE-2019-13617 State: PUBLISHED Published: 2019-07-16T16:07:00 Last Updated: 2024-08-04T23:57:39.467Z Vendors: n/a Products: n/a Problem Types: n/a Description: njs through 0.3.3, used in NGINX, has a heap-based buffer over-read in nxt_vsprintf in nxt/nxt_sprintf.c during error handling, as demonstrated by an njs_regexp_literal call that leads to an njs_parser_lexer_error call and then an njs_parser_scope_error call. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nginx/njs/issues/174 - https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15093
CVE ID: CVE-2019-13618 State: PUBLISHED Published: 2019-07-16T16:07:17 Last Updated: 2024-08-04T23:57:39.520Z Vendors: n/a Products: n/a Problem Types: n/a Description: In GPAC before 0.8.0, isomedia/isom_read.c in libgpac.a has a heap-based buffer over-read, as demonstrated by a crash in gf_m2ts_sync in media_tools/mpegts.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gpac/gpac/issues/1250 - https://github.com/gpac/gpac/compare/440d475...6b4ab40 - https://lists.debian.org/debian-lts-announce/2020/01/msg00017.html
CVE ID: CVE-2019-13619 State: PUBLISHED Published: 2019-07-17T19:18:03 Last Updated: 2024-08-04T23:57:39.523Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Wireshark 3.0.0 to 3.0.2, 2.6.0 to 2.6.9, and 2.4.0 to 2.4.15, the ASN.1 BER dissector and related dissectors could crash. This was addressed in epan/asn1.c by properly restricting buffer increments. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15870 - https://www.wireshark.org/security/wnpa-sec-2019-20.html - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=7e90aed666e809c0db5de9d1816802a7dcea28d9 - http://www.securityfocus.com/
rg/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=7e90aed666e809c0db5de9d1816802a7dcea28d9 - http://www.securityfocus.com/bid/109293 - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00068.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JY52XAC2UNC4X4ZPIXYMK5SVXV2PO5I3/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q4QVJALLGVVC7MBUT4B4SHQVDXGJKGI7/ - https://usn.ubuntu.com/4133-1/ - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html - https://lists.debian.org/debian-lts-announce/2021/02/msg00008.html
CVE ID: CVE-2019-13623 State: PUBLISHED Published: 2019-07-17T02:07:04 Last Updated: 2024-08-04T23:57:39.485Z Vendors: n/a Products: n/a Problem Types: n/a Description: In NSA Ghidra before 9.1, path traversal can occur in RestoreTask.java (from the package ghidra.app.plugin.core.archive) via an archive with an executable file that has an initial ../ in its filename. This allows attackers to overwrite arbitrary files in scenarios where an intermediate analysis result is archived for sharing with other persons. To achieve arbitrary code execution, one approach is to overwrite some critical Ghidra modules, e.g., the decompile module. Additional Analyst Notes: - CVE Program Container: Reference
e some critical Ghidra modules, e.g., the decompile module. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/NationalSecurityAgency/ghidra/issues/789 - http://blog.fxiao.me/ghidra/ - http://packetstormsecurity.com/files/154015/Ghidra-Linux-9.0.4-Arbitrary-Code-Execution.html - https://ghidra-sre.org/releaseNotes_9.1_final.html
CVE ID: CVE-2019-13624 State: PUBLISHED Published: 2019-07-17T02:15:54 Last Updated: 2024-08-04T23:57:39.467Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ONOS 1.15.0, apps/yang/web/src/main/java/org/onosproject/yang/web/YangWebResource.java mishandles backquote characters within strings that can be used in a shell command. Additional Analyst Notes: - CVE Program Container: References: - https://gerrit.onosproject.org/#/c/20767/
CVE ID: CVE-2019-13625 State: PUBLISHED Published: 2019-07-17T02:38:32 Last Updated: 2024-08-04T23:57:39.540Z Vendors: n/a Products: n/a Problem Types: n/a Description: NSA Ghidra before 9.0.1 allows XXE when a project is opened or restored, or a tool is imported, as demonstrated by a project.prp file. Additional Analyst Notes: - CVE Program Container: References: - http://blog.fxiao.me/ghidra/ - https://xlab.tencent.com/en/2019/03/18/ghidra-from-xxe-to-rce/ - https://github.com/NationalSecurityAgency/ghidra/issues/71
CVE ID: CVE-2019-13626 State: PUBLISHED Published: 2019-07-17T00:00:00 Last Updated: 2024-08-04T23:57:39.518Z Vendors: n/a Products: n/a Problem Types: n/a Description: SDL (Simple DirectMedia Layer) 2.x through 2.0.9 has a heap-based buffer over-read in Fill_IMA_ADPCM_block, caused by an integer overflow in IMA_ADPCM_decode() in audio/SDL_wave.c. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.libsdl.org/show_bug.cgi?id=4522 - https://security.gentoo.org/glsa/201909-07 - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00093.html - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00094.html - https://lists.fedoraproject.org/arc
.html - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00094.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GY6FDFPYUJ7YPY3XB5U75VJHBSVRVIKO/ - https://lists.debian.org/debian-lts-announce/2023/02/msg00008.html
CVE ID: CVE-2019-13627 State: PUBLISHED Published: 2019-09-25T14:44:45 Last Updated: 2024-08-04T23:57:39.524Z Vendors: n/a Products: n/a Problem Types: n/a Description: It was discovered that there was a ECDSA timing attack in the libgcrypt20 cryptographic library. Version affected: 1.8.4-5, 1.7.6-2+deb9u3, and 1.6.3-2+deb8u4. Versions fixed: 1.8.5-2 and 1.6.3-2+deb8u7. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00060.html - https://lists.debian.org/debian-lts-announce/2019/09/msg00024.html - https://security-tracker.debian.org/tracker/CVE-2019-13627 - https://github.com/gpg/libgcrypt/releases/tag/libgcrypt
l - https://security-tracker.debian.org/tracker/CVE-2019-13627 - https://github.com/gpg/libgcrypt/releases/tag/libgcrypt-1.8.5 - http://www.openwall.com/lists/oss-security/2019/10/02/2 - https://minerva.crocs.fi.muni.cz/ - https://lists.debian.org/debian-lts-announce/2020/01/msg00001.html - https://usn.ubuntu.com/4236-1/ - http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00018.html - https://usn.ubuntu.com/4236-2/ - https://usn.ubuntu.com/4236-3/ - https://security.gentoo.org/glsa/202003-32
CVE ID: CVE-2019-13628 State: PUBLISHED Published: 2019-10-03T13:20:44 Last Updated: 2024-08-04T23:57:39.493Z Vendors: n/a Products: n/a Problem Types: n/a Description: wolfSSL and wolfCrypt 4.0.0 and earlier (when configured without --enable-fpecc, --enable-sp, or --enable-sp-math) contain a timing side channel in ECDSA signature generation. This allows a local attacker, able to precisely measure the duration of signature operations, to infer information about the nonces used and potentially mount a lattice attack to recover the private key used. The issue occurs because ecc.c scalar multiplication might leak the bit length. Additional Analyst Notes: - CVE Program Container: References: - h
cc.c scalar multiplication might leak the bit length. Additional Analyst Notes: - CVE Program Container: References: - https://eprint.iacr.org/2011/232.pdf - https://tches.iacr.org/index.php/TCHES/article/view/7337 - http://www.openwall.com/lists/oss-security/2019/10/02/2 - https://minerva.crocs.fi.muni.cz/
CVE ID: CVE-2019-13629 State: PUBLISHED Published: 2019-10-03T13:23:25 Last Updated: 2024-08-04T23:57:39.514Z Vendors: n/a Products: n/a Problem Types: n/a Description: MatrixSSL 4.2.1 and earlier contains a timing side channel in ECDSA signature generation. This allows a local or a remote attacker, able to measure the duration of hundreds to thousands of signing operations, to compute the private key used. The issue occurs because crypto/pubkey/ecc_math.c scalar multiplication leaks the bit length of the scalar. Additional Analyst Notes: - CVE Program Container: References: - https://eprint.iacr.org/2011/232.pdf - https://tches.iacr.org/index.php/TCHES/article/view/7337 - http://www.openwal
: - https://eprint.iacr.org/2011/232.pdf - https://tches.iacr.org/index.php/TCHES/article/view/7337 - http://www.openwall.com/lists/oss-security/2019/10/02/2 - https://minerva.crocs.fi.muni.cz/
CVE ID: CVE-2019-13631 State: PUBLISHED Published: 2019-07-17T18:11:34 Last Updated: 2024-08-04T23:57:39.644Z Vendors: n/a Products: n/a Problem Types: n/a Description: In parse_hid_report_descriptor in drivers/input/tablet/gtco.c in the Linux kernel through 5.2.1, a malicious USB device can send an HID report that triggers an out-of-bounds write during generation of debugging messages. Additional Analyst Notes: - CVE Program Container: References: - https://patchwork.kernel.org/patch/11040813/ - http://www.securityfocus.com/bid/109291 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TUXTJSLIQBOJTQDMTUQTQKUWWAJLFVEY/ - https://lists.fedorapro
ives/list/package-announce%40lists.fedoraproject.org/message/TUXTJSLIQBOJTQDMTUQTQKUWWAJLFVEY/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KQ5BQKTI24DPSVKPOIMMGDTFKCF6ASXT/ - https://security.netapp.com/advisory/ntap-20190806-0001/ - https://www.debian.org/security/2019/dsa-4495 - https://seclists.org/bugtraq/2019/Aug/13 - https://seclists.org/bugtraq/2019/Aug/18 - https://www.debian.org/security/2019/dsa-4497 - https://lists.debian.org/debian-lts-announce/2019/08/msg00016.html - https://seclists.org/bugtraq/2019/Aug/26 - https://lists.debian.org/debian-lts-announce/2019/08/msg00017.html - http://packetstormsecurity.com/files/154059/Slac
- https://lists.debian.org/debian-lts-announce/2019/08/msg00017.html - http://packetstormsecurity.com/files/154059/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00055.html - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00056.html - https://usn.ubuntu.com/4115-1/ - https://usn.ubuntu.com/4118-1/ - https://usn.ubuntu.com/4145-1/ - https://usn.ubuntu.com/4147-1/
CVE ID: CVE-2019-13633 State: PUBLISHED Published: 2020-10-19T19:17:28 Last Updated: 2024-08-04T23:57:39.519Z Vendors: n/a Products: n/a Problem Types: n/a Description: Blinger.io v.1.0.2519 is vulnerable to Blind/Persistent XSS. An attacker can send arbitrary JavaScript code via a built-in communication channel, such as Telegram, WhatsApp, Viber, Skype, Facebook, Vkontakte, or Odnoklassniki. This is mishandled within the administration panel for conversations/all, conversations/inbox, conversations/unassigned, and conversations/closed. Additional Analyst Notes: - CVE Program Container: References: - https://blinger.io/ - https://github.com/Security-AVS/CVE-2019-13633
CVE ID: CVE-2019-13635 State: PUBLISHED Published: 2019-07-30T12:20:44 Last Updated: 2024-08-04T23:57:39.541Z Vendors: n/a Products: n/a Problem Types: n/a Description: The WP Fastest Cache plugin through 0.8.9.5 for WordPress allows wpFastestCache.php and inc/cache.php Directory Traversal. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/wp-fastest-cache/#developers - https://plugins.trac.wordpress.org/changeset/2124619 - https://plugins.trac.wordpress.org/changeset/2124614 - https://seclists.org/bugtraq/2019/Jul/53 - http://packetstormsecurity.com/files/153821/WordPress-WP-Fastest-Cache-0.8.9.5-Directory-Traversal.html - https://wpvulndb.com/vu
cketstormsecurity.com/files/153821/WordPress-WP-Fastest-Cache-0.8.9.5-Directory-Traversal.html - https://wpvulndb.com/vulnerabilities/9507
CVE ID: CVE-2019-13636 State: PUBLISHED Published: 2019-07-17T20:04:00 Last Updated: 2024-08-04T23:57:39.470Z Vendors: n/a Products: n/a Problem Types: n/a Description: In GNU patch through 2.7.6, the following of symlinks is mishandled in certain cases other than input files. This affects inp.c and util.c. Additional Analyst Notes: - CVE Program Container: References: - https://git.savannah.gnu.org/cgit/patch.git/commit/?id=dce4683cbbe107a95f1f0d45fabc304acfb5d71a - https://lists.debian.org/debian-lts-announce/2019/07/msg00016.html - https://usn.ubuntu.com/4071-1/ - https://usn.ubuntu.com/4071-2/ - https://www.debian.org/security/2019/dsa-4489 - https://seclists.org/bugtraq/2019/Jul/54 - ht
//usn.ubuntu.com/4071-2/ - https://www.debian.org/security/2019/dsa-4489 - https://seclists.org/bugtraq/2019/Jul/54 - https://seclists.org/bugtraq/2019/Aug/29 - http://packetstormsecurity.com/files/154124/GNU-patch-Command-Injection-Directory-Traversal.html - https://security.gentoo.org/glsa/201908-22 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVWWGISFWACROJJPVJJL4UBLVZ7LPOLT/ - https://security.netapp.com/advisory/ntap-20190828-0001/ - https://github.com/irsl/gnu-patch-vulnerabilities
CVE ID: CVE-2019-13637 State: PUBLISHED Published: 2019-07-17T20:17:52 Last Updated: 2024-08-04T23:57:39.485Z Vendors: n/a Products: n/a Problem Types: n/a Description: In LogMeIn join.me before 3.16.0.5505, an attacker could execute arbitrary commands on a targeted system. This vulnerability is due to unsafe search paths used by the application URI that is defined in Windows. An attacker could exploit this vulnerability by convincing a targeted user to follow a malicious link. Successful exploitation could cause the application to load libraries from the directory targeted by the URI link. The attacker could use this behavior to execute arbitrary commands on the system with the privileges o
by the URI link. The attacker could use this behavior to execute arbitrary commands on the system with the privileges of the targeted user if the attacker can place a crafted library in a directory that is accessible to the vulnerable system. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/active-labs/Advisories/blob/master/ACTIVE-2019-009.md