Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-17415 State: PUBLISHED Published: 2019-10-09T21:52:40 Last Updated: 2024-08-05T01:40:15.694Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Structured Exception Handler (SEH) based buffer overflow in File Sharing Wizard 1.5.0 26-8-2008 allows remote unauthenticated attackers to execute arbitrary code via the HTTP DELETE method, a similar issue to CVE-2019-16724 and CVE-2010-2331. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/154738/File-Sharing-Wizard-1.5.0-DELETE-SEH-Buffer-Overflow.html
CVE ID: CVE-2019-17417 State: PUBLISHED Published: 2019-10-09T22:30:45 Last Updated: 2024-08-05T01:40:15.432Z Vendors: n/a Products: n/a Problem Types: n/a Description: PbootCMS 2.0.2 allows XSS via vectors involving the Pboot/admin.php?p=/Single/index/mcode/1 and Pboot/?contact/ URIs. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/lolipop1234/XXD/issues/2
CVE ID: CVE-2019-17418 State: PUBLISHED Published: 2019-10-09T22:55:34 Last Updated: 2024-08-05T01:40:15.559Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MetInfo 7.0. There is SQL injection via the admin/?n=language&c=language_general&a=doSearchParameter appno parameter, a different issue than CVE-2019-16997. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/evi1code/Just-for-fun/issues/2
CVE ID: CVE-2019-17419 State: PUBLISHED Published: 2019-10-09T22:55:17 Last Updated: 2024-08-05T01:40:15.371Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MetInfo 7.0. There is SQL injection via the admin/?n=user&c=admin_user&a=doGetUserInfo id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/evi1code/Just-for-fun/issues/1
CVE ID: CVE-2019-17420 State: PUBLISHED Published: 2019-10-09T23:29:04 Last Updated: 2024-08-05T01:40:15.367Z Vendors: n/a Products: n/a Problem Types: n/a Description: In OISF LibHTP before 0.5.31, as used in Suricata 4.1.4 and other products, an HTTP protocol parsing error causes the http_header signature to not alert on a response with a single \r\n ending. Additional Analyst Notes: - CVE Program Container: References: - https://redmine.openinfosecfoundation.org/issues/2969 - https://github.com/OISF/libhtp/compare/0.5.30...0.5.31 - https://github.com/OISF/libhtp/pull/213
CVE ID: CVE-2019-17421 State: PUBLISHED Published: 2019-11-21T14:36:02 Last Updated: 2024-08-05T01:40:15.532Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect file permissions on the packaged Nipper executable file in Zoho ManageEngine OpManager 12.4.072 and Firewall Analyzer 12.4.072 allow local users to elevate privileges to root by overwriting this file with a malicious payload. Additional Analyst Notes: - CVE Program Container: References: - https://twitter.com/va_start - https://blog.vastart.dev/2019/11/cve-2019-17421-privilege-escalation.html - https://www.manageengine.com/products/firewall/security-updates/cve-2019-17421.html
CVE ID: CVE-2019-17424 State: PUBLISHED Published: 2019-10-22T11:54:22 Last Updated: 2024-08-05T01:40:15.900Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stack-based buffer overflow in the processPrivilage() function in IOS/process-general.c in nipper-ng 0.11.10 allows remote attackers (serving firewall configuration files) to achieve Remote Code Execution or Denial Of Service via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://twitter.com/va_start - https://code.google.com/archive/p/nipper-ng/source/default/source - https://blog.vastart.dev/2019/10/stack-overflow-cve-2019-17424.html - https://github.com/guywhataguy/CVE-2019-17424 - h
https://blog.vastart.dev/2019/10/stack-overflow-cve-2019-17424.html - https://github.com/guywhataguy/CVE-2019-17424 - http://packetstormsecurity.com/files/155378/nipper-ng-0.11.10-Remote-Buffer-Overflow.html
CVE ID: CVE-2019-17426 State: PUBLISHED Published: 2019-10-10T00:35:17 Last Updated: 2024-08-05T01:40:15.456Z Vendors: n/a Products: n/a Problem Types: n/a Description: Automattic Mongoose through 5.7.4 allows attackers to bypass access control (in some applications) because any query object with a _bsontype attribute is ignored. For example, adding "_bsontype":"a" can sometimes interfere with a query filter. NOTE: this CVE is about Mongoose's failure to work around this _bsontype special case that exists in older versions of the bson parser (aka the mongodb/js-bson project). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Automattic/mongoose/issues/8222 -
). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Automattic/mongoose/issues/8222 - https://github.com/Automattic/mongoose/commit/f3eca5b94d822225c04e96cbeed9f095afb3c31c
CVE ID: CVE-2019-17427 State: PUBLISHED Published: 2019-10-10T00:42:09 Last Updated: 2024-08-05T01:40:15.424Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Redmine before 3.4.11 and 4.0.x before 4.0.4, persistent XSS exists due to textile formatting errors. Additional Analyst Notes: - CVE Program Container: References: - https://www.redmine.org/projects/redmine/wiki/Security_Advisories - https://www.debian.org/security/2019/dsa-4574 - https://seclists.org/bugtraq/2019/Nov/31 - https://usn.ubuntu.com/4200-1/ - https://github.com/RealLinkers/CVE-2019-17427
CVE ID: CVE-2019-17428 State: PUBLISHED Published: 2019-12-12T13:44:28 Last Updated: 2024-08-05T01:40:15.761Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Intesync Solismed 3.3sp1. An flaw in the encryption implementation exists, allowing for all encrypted data stored within the database to be decrypted. Additional Analyst Notes: - CVE Program Container: References: - https://www.solismed.com/ - https://know.bishopfox.com/advisories - https://know.bishopfox.com/advisories/solismed-critical
CVE ID: CVE-2019-17429 State: PUBLISHED Published: 2019-10-10T10:46:58 Last Updated: 2024-08-05T01:40:15.799Z Vendors: n/a Products: n/a Problem Types: n/a Description: Adhouma CMS through 2019-10-09 has SQL Injection via the post.php p_id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Adhouma/cms/issues/1
CVE ID: CVE-2019-17430 State: PUBLISHED Published: 2019-10-10T10:45:29 Last Updated: 2024-08-05T01:40:15.507Z Vendors: n/a Products: n/a Problem Types: n/a Description: EyouCms through 2019-07-11 has XSS related to the login.php web_recordnum parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/eyoucms/eyoucms/issues/1 - https://github.com/eyoucms/eyoucms/blob/a809931d8ae0a94584f472cdedabf6f3cf42bd57/core/library/think/template/taglib/eyou/TagGlobal.php#L116-L119
CVE ID: CVE-2019-17431 State: PUBLISHED Published: 2019-10-10T11:15:53 Last Updated: 2024-08-05T01:40:15.687Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in fastadmin 1.0.0.20190705_beta. There is a public/index.php/admin/auth/admin/add CSRF vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Imanfeng/fastadmin/blob/master/README.md
CVE ID: CVE-2019-17432 State: PUBLISHED Published: 2019-10-10T11:15:31 Last Updated: 2024-08-05T01:40:15.721Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in fastadmin 1.0.0.20190705_beta. There is a public/admin/general.config/edit CSRF vulnerability, as demonstrated by resultant XSS via the row&#91;name&#93; parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Imanfeng/fastadmin/blob/master/README.md
CVE ID: CVE-2019-17433 State: PUBLISHED Published: 2019-10-10T11:40:29 Last Updated: 2024-08-05T01:40:15.910Z Vendors: n/a Products: n/a Problem Types: n/a Description: z-song laravel-admin 1.7.3 has XSS via the Slug or Name on the Roles screen, because of mishandling on the "Operation log" screen. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/z-song/laravel-admin/issues/3847
CVE ID: CVE-2019-17434 State: PUBLISHED Published: 2019-10-10T11:40:40 Last Updated: 2024-08-05T01:40:15.818Z Vendors: n/a Products: n/a Problem Types: n/a Description: LavaLite through 5.7 has XSS via a crafted account name that is mishandled on the Manage Clients screen. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/LavaLite/cms/issues/304
CVE ID: CVE-2019-17435 State: PUBLISHED Published: 2019-10-16T18:06:47 Last Updated: 2024-08-05T01:40:15.808Z Vendors: Palo Alto Networks Products: GlobalProtect Agent for Windows Problem Types: Escalation of Privilege Description: A Local Privilege Escalation vulnerability exists in the GlobalProtect Agent for Windows 5.0.3 and earlier, and GlobalProtect Agent for Windows 4.1.12 and earlier, in which the auto-update feature can allow for modification of a GlobalProtect Agent MSI installer package on disk before installation. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2019-17435
CVE ID: CVE-2019-17436 State: PUBLISHED Published: 2019-10-16T18:06:44 Last Updated: 2024-08-05T01:40:15.863Z Vendors: Palo Alto Networks Products: GlobalProtect Agent for Linux and OSX Problem Types: Escalation of Privilege Description: A Local Privilege Escalation vulnerability exists in GlobalProtect Agent for Linux and Mac OS X version 5.0.4 and earlier and version 4.1.12 and earlier, that can allow non-root users to overwrite root files on the file system. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2019-17436
CVE ID: CVE-2019-17437 State: PUBLISHED Published: 2019-12-05T14:11:11.290884Z Last Updated: 2024-09-17T04:10:31.450Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Palo Alto Networks Products: PAN-OS Problem Types: CWE-280 Description: An improper authentication check in Palo Alto Networks PAN-OS may allow an authenticated low privileged non-superuser custom role user to elevate privileges and become superuser. This issue affects PAN-OS 7.1 versions prior to 7.1.25; 8.0 versions prior to 8.0.20; 8.1 versions prior to 8.1.11; 9.0 versions prior to 9.0.5. PAN-OS version 7.0 and prior EOL versions have not been evaluated for this issue. Additional Analyst Notes
ior to 9.0.5. PAN-OS version 7.0 and prior EOL versions have not been evaluated for this issue. Additional Analyst Notes: - CVE Program Container: References: - https://securityadvisories.paloaltonetworks.com/Home/Detail/159
CVE ID: CVE-2019-17438 State: REJECTED Published: N/A Last Updated: 2022-12-30T00:00:00 Description: No description available.
CVE ID: CVE-2019-17439 State: REJECTED Published: N/A Last Updated: 2022-12-30T00:00:00 Description: No description available.
CVE ID: CVE-2019-17440 State: PUBLISHED Published: 2019-12-20T15:22:18.040020Z Last Updated: 2024-09-17T01:56:43.008Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Palo Alto Networks Products: PAN-OS Problem Types: CWE-923 Description: Improper restriction of communications to Log Forwarding Card (LFC) on PA-7000 Series devices with second-generation Switch Management Card (SMC) may allow an attacker with network access to the LFC to gain root access to PAN-OS. This issue affects PAN-OS 9.0 versions prior to 9.0.5-h3 on PA-7080 and PA-7050 devices with an LFC installed and configured. This issue does not affect PA-7000 Series deployments using the first-g
50 devices with an LFC installed and configured. This issue does not affect PA-7000 Series deployments using the first-generation SMC and the Log Processing Card (LPC). This issue does not affect any other PA series devices. This issue does not affect devices without an LFC. This issue does not affect PAN-OS 8.1 or prior releases. This issue only affected a very limited number of customers and we undertook individual outreach to help them upgrade. At the time of publication, all identified customers have upgraded SW or content and are not impacted. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2019-17440
CVE ID: CVE-2019-17441 State: REJECTED Published: N/A Last Updated: 2022-12-30T00:00:00 Description: No description available.
CVE ID: CVE-2019-17442 State: REJECTED Published: N/A Last Updated: 2022-12-30T00:00:00 Description: No description available.
CVE ID: CVE-2019-17443 State: REJECTED Published: N/A Last Updated: 2022-12-30T00:00:00 Description: No description available.
CVE ID: CVE-2019-17444 State: PUBLISHED Published: 2020-10-12T21:55:55.271295Z Last Updated: 2024-09-16T19:51:55.985Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Jfrog Products: Artifactory Problem Types: CWE-521 Description: Jfrog Artifactory uses default passwords (such as "password") for administrative accounts and does not require users to change them. This may allow unauthorized network-based attackers to completely compromise of Jfrog Artifactory. This issue affects Jfrog Artifactory versions prior to 6.17.0. Additional Analyst Notes: - CVE Program Container: References: - https://www.jfrog.com/confluence/display/JFROG/JFrog+Artifactory - https:/
Notes: - CVE Program Container: References: - https://www.jfrog.com/confluence/display/JFROG/JFrog+Artifactory - https://www.jfrog.com/confluence/display/JFROG/Artifactory+Release+Notes
CVE ID: CVE-2019-17445 State: PUBLISHED Published: 2019-11-22T17:18:38 Last Updated: 2024-08-05T01:40:16.053Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Eracent EDA, EPA, EPM, EUA, FLW, and SUM Agent through 10.2.26. The agent executable, when installed for non-root operations (scanning), can be forced to copy files from the filesystem to other locations via Symbolic Link Following. Additional Analyst Notes: - CVE Program Container: References: - https://eracent.com/security-bulletin-cve-2019-17445/
CVE ID: CVE-2019-17446 State: PUBLISHED Published: 2019-11-22T17:36:00 Last Updated: 2024-08-05T01:40:15.851Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Eracent EPA Agent through 10.2.26. The agent executable, when installed for non-root operations (scanning), can be used to start external programs with elevated permissions because of an Untrusted Search Path. Additional Analyst Notes: - CVE Program Container: References: - https://eracent.com/security-bulletin-cve-2019-17446/
CVE ID: CVE-2019-17449 State: PUBLISHED Published: 2019-10-10T15:58:49 Last Updated: 2024-08-05T01:40:15.837Z Vendors: n/a Products: n/a Problem Types: n/a Description: Avira Software Updater before 2.0.6.21094 allows a DLL side-loading attack. NOTE: The vendor thinks that this vulnerability is invalid because exploiting it would require at least administrator privileges and would gain only SYSTEM privileges Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.avira.com/hc/en-us/articles/360000142857-Avira-Software-Updater - https://safebreach.com/Post/Avira-Antivirus-2019-4-Services-DLL-Preloading-and-Potential-Abuses-CVE-2019-17449
CVE ID: CVE-2019-17450 State: PUBLISHED Published: 2019-10-10T16:21:02 Last Updated: 2024-08-05T01:40:15.800Z Vendors: n/a Products: n/a Problem Types: n/a Description: find_abstract_instance in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32, allows remote attackers to cause a denial of service (infinite recursion and application crash) via a crafted ELF file. Additional Analyst Notes: - CVE Program Container: References: - https://sourceware.org/bugzilla/show_bug.cgi?id=25078 - https://security.netapp.com/advisory/ntap-20191024-0002/ - https://usn.ubuntu.com/4336-1/ - https://security.gentoo.org/glsa/202007-39 - http://lists.opensuse.o
p-20191024-0002/ - https://usn.ubuntu.com/4336-1/ - https://security.gentoo.org/glsa/202007-39 - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00078.html - http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00004.html
CVE ID: CVE-2019-17451 State: PUBLISHED Published: 2019-10-10T16:20:50 Last Updated: 2024-08-05T01:40:15.795Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. It is an integer overflow leading to a SEGV in _bfd_dwarf2_find_nearest_line in dwarf2.c, as demonstrated by nm. Additional Analyst Notes: - CVE Program Container: References: - https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=336bfbeb1848f4b9558456fdcf283ee8a32d7fd1 - https://sourceware.org/bugzilla/show_bug.cgi?id=25070 - https://security.netapp.com/advisory/ntap-20191024-0002/ - https://usn.ubu
urceware.org/bugzilla/show_bug.cgi?id=25070 - https://security.netapp.com/advisory/ntap-20191024-0002/ - https://usn.ubuntu.com/4336-1/ - https://security.gentoo.org/glsa/202007-39 - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00078.html - http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00004.html
CVE ID: CVE-2019-17452 State: PUBLISHED Published: 2019-10-10T16:46:16 Last Updated: 2024-08-05T01:40:15.911Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bento4 1.5.1.0 has a NULL pointer dereference in AP4_DescriptorListInspector::Action in Core/Ap4Descriptor.h, related to AP4_IodsAtom::InspectFields in Core/Ap4IodsAtom.cpp, as demonstrated by mp4dump. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/axiomatic-systems/Bento4/issues/434
CVE ID: CVE-2019-17453 State: PUBLISHED Published: 2019-10-10T16:46:04 Last Updated: 2024-08-05T01:40:15.945Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bento4 1.5.1.0 has a NULL pointer dereference in AP4_DescriptorListWriter::Action in Core/Ap4Descriptor.h, related to AP4_IodsAtom::WriteFields in Core/Ap4IodsAtom.cpp, as demonstrated by mp4encrypt or mp4compact. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/axiomatic-systems/Bento4/issues/437 - https://github.com/axiomatic-systems/Bento4/issues/436
CVE ID: CVE-2019-17454 State: PUBLISHED Published: 2019-10-10T16:45:54 Last Updated: 2024-08-05T01:40:15.792Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bento4 1.5.1.0 has a NULL pointer dereference in AP4_Descriptor::GetTag in Core/Ap4Descriptor.h, related to AP4_StsdAtom::GetSampleDescription in Core/Ap4StsdAtom.cpp, as demonstrated by mp4info. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/axiomatic-systems/Bento4/issues/435
CVE ID: CVE-2019-17455 State: PUBLISHED Published: 2019-10-10T17:17:48 Last Updated: 2024-08-05T01:40:15.921Z Vendors: n/a Products: n/a Problem Types: n/a Description: Libntlm through 1.5 relies on a fixed buffer size for tSmbNtlmAuthRequest, tSmbNtlmAuthChallenge, and tSmbNtlmAuthResponse read and write operations, as demonstrated by a stack-based buffer over-read in buildSmbNtlmAuthRequest in smbutil.c for a crafted NTLM request. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/jas/libntlm/issues/2 - https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-17455.html - https://security-tracker.debian.org/tracker/CVE-2019-17455 - https://bugs.debia
-security/cve/2019/CVE-2019-17455.html - https://security-tracker.debian.org/tracker/CVE-2019-17455 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=942145 - https://lists.debian.org/debian-lts-announce/2020/05/msg00010.html - http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00029.html - http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00032.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3BVFO3OVJPMSGIXBKNOCVOJZ3UTGZQF5/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZ5YWYNOJ5HMCKAHWLTY4MXZQWJJCBI7/ - https://lists.debian.org/debian-lts-announce/2021/
40lists.fedoraproject.org/message/YZ5YWYNOJ5HMCKAHWLTY4MXZQWJJCBI7/ - https://lists.debian.org/debian-lts-announce/2021/11/msg00026.html
CVE ID: CVE-2019-17488 State: PUBLISHED Published: 2019-10-10T20:18:00 Last Updated: 2024-08-05T01:40:15.851Z Vendors: n/a Products: n/a Problem Types: n/a Description: b3log Symphony (aka Sym) before 3.6.0 has XSS via the HTTP User-Agent header. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/b3log/symphony/issues/970
CVE ID: CVE-2019-17489 State: PUBLISHED Published: 2019-10-10T20:17:33 Last Updated: 2024-08-05T01:40:15.934Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jiangnan Online Judge (aka jnoj) 0.8.0 has XSS via the Problem[title] parameter to web/polygon/problem/create or web/polygon/problem/update or web/admin/problem/create. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/shi-yang/jnoj/issues/51
CVE ID: CVE-2019-17490 State: PUBLISHED Published: 2019-10-10T20:17:23 Last Updated: 2024-08-05T01:40:15.905Z Vendors: n/a Products: n/a Problem Types: n/a Description: app\modules\polygon\controllers\ProblemController in Jiangnan Online Judge (aka jnoj) 0.8.0 allows arbitrary file upload, as demonstrated by PHP code (with a .php filename but the image/png content type) to the web/polygon/problem/tests URI. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/shi-yang/jnoj/issues/51
CVE ID: CVE-2019-17491 State: PUBLISHED Published: 2019-10-10T20:17:15 Last Updated: 2024-08-05T01:40:15.805Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jiangnan Online Judge (aka jnoj) 0.8.0 has XSS via the Problem[description] parameter to web/admin/problem/create or web/polygon/problem/update. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/shi-yang/jnoj/issues/51
CVE ID: CVE-2019-17493 State: PUBLISHED Published: 2019-10-10T20:16:54 Last Updated: 2024-08-05T01:40:15.827Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jiangnan Online Judge (aka jnoj) 0.8.0 has XSS via the Problem[sample_input] parameter to web/admin/problem/create or web/polygon/problem/update. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/shi-yang/jnoj/issues/51
CVE ID: CVE-2019-17494 State: PUBLISHED Published: 2019-10-10T20:16:42 Last Updated: 2024-08-05T01:40:15.918Z Vendors: n/a Products: n/a Problem Types: n/a Description: laravel-bjyblog 6.1.1 has XSS via a crafted URL. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/baijunyao/laravel-bjyblog/issues/118
CVE ID: CVE-2019-17495 State: PUBLISHED Published: 2019-10-10T21:04:49 Last Updated: 2024-08-05T01:40:15.904Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite (RPO) technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows the embedding of untrusted JSON data from remote servers, but it was not previously known that <style>@import within the JSON data was a functional attack method. Additional Analyst Notes: - CVE Program Container: References: - http
thin the JSON data was a functional attack method. Additional Analyst Notes: - CVE Program Container: References: - https://www.oracle.com/security-alerts/cpuoct2020.html - https://github.com/tarantula-team/CSS-injection-in-Swagger-UI - https://github.com/swagger-api/swagger-ui/releases/tag/v3.23.11 - https://www.oracle.com/security-alerts/cpuApr2021.html - https://lists.apache.org/thread.html/r3acb7e494cf1aab99b6784b7c5bbddfd0d4f8a484ab534c3a61ef9cf%40%3Ccommits.airflow.apache.org%3E - https://lists.apache.org/thread.html/r103579b01da2d0aa0f672b88f811224bbf8ef493aaad845895955e91%40%3Ccommits.airflow.apache.org%3E - https://lists.apache.org/thread.html/ref70b940c4f69560d29d6ba792d6c82865e74d