Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-12730 State: PUBLISHED Published: 2019-06-04T13:14:23 Last Updated: 2024-08-04T23:32:54.100Z Vendors: n/a Products: n/a Problem Types: n/a Description: aa_read_header in libavformat/aadec.c in FFmpeg before 3.2.14 and 4.x before 4.1.4 does not check for sscanf failure and consequently allows use of uninitialized variables. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FFmpeg/FFmpeg/commit/ed188f6dcdf0935c939ed813cf8745d50742014b - https://github.com/FFmpeg/FFmpeg/compare/a97ea53...ba11e40 - https://git.ffmpeg.org/gitweb/ffmpeg.git/shortlog/n4.1.4 - https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/9b4004c054964a49c7ba44583f4cee22486dd8f2 -
/ffmpeg.git/shortlog/n4.1.4 - https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/9b4004c054964a49c7ba44583f4cee22486dd8f2 - http://www.securityfocus.com/bid/109317 - https://seclists.org/bugtraq/2019/Aug/30 - https://www.debian.org/security/2019/dsa-4502 - https://security.gentoo.org/glsa/202003-65 - https://usn.ubuntu.com/4431-1/
CVE ID: CVE-2019-12731 State: PUBLISHED Published: 2019-07-12T16:23:45 Last Updated: 2024-08-04T23:32:54.212Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Windows versions of Snapview Mikogo, versions before 5.10.2 are affected by insecure implementations which allow local attackers to escalate privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.detack.de/en/cve-2019-12731
CVE ID: CVE-2019-12732 State: PUBLISHED Published: 2019-06-06T14:54:18 Last Updated: 2024-08-04T23:32:54.175Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Chartkick gem through 3.1.0 for Ruby allows XSS. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ankane/chartkick/issues/488 - https://github.com/ankane/chartkick/blob/master/CHANGELOG.md
CVE ID: CVE-2019-12733 State: PUBLISHED Published: 2019-12-06T16:46:32 Last Updated: 2024-08-04T23:32:54.196Z Vendors: n/a Products: n/a Problem Types: n/a Description: SiteVision 4 allows Remote Code Execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.cybercom.com/About-Cybercom/Blogs/Security-Advisories/high-risk-vulnerabilities-in-cms-product/ - https://www.cybercom.com/contentassets/ac929be030744b8e92dc6e457fdb7dcc/sitevision-disclosure-rce.pdf - http://seclists.org/fulldisclosure/2019/Dec/13 - http://seclists.org/fulldisclosure/2019/Dec/12 - http://packetstormsecurity.com/files/155585/SiteVision-4.x-5.x-Remote-Code-Execution.html - https://www.sitevis
Dec/12 - http://packetstormsecurity.com/files/155585/SiteVision-4.x-5.x-Remote-Code-Execution.html - https://www.sitevision.se/
CVE ID: CVE-2019-12734 State: PUBLISHED Published: 2019-12-06T16:47:28 Last Updated: 2024-08-04T23:32:54.191Z Vendors: n/a Products: n/a Problem Types: n/a Description: SiteVision 4 has Incorrect Access Control. Additional Analyst Notes: - CVE Program Container: References: - https://www.cybercom.com/About-Cybercom/Blogs/Security-Advisories/high-risk-vulnerabilities-in-cms-product/ - https://www.cybercom.com/contentassets/ac929be030744b8e92dc6e457fdb7dcc/sitevision-disclosure-insufficient-access-control.pdf - http://seclists.org/fulldisclosure/2019/Dec/13 - http://seclists.org/fulldisclosure/2019/Dec/12 - http://packetstormsecurity.com/files/155584/SiteVision-4.x-5.x-Insufficient-Module-Acce
org/fulldisclosure/2019/Dec/12 - http://packetstormsecurity.com/files/155584/SiteVision-4.x-5.x-Insufficient-Module-Access-Control.html - https://www.sitevision.se/
CVE ID: CVE-2019-12735 State: PUBLISHED Published: 2019-06-05T13:07:48.000Z Last Updated: 2025-11-11T16:50:16.838Z Vendors: n/a Products: n/a Problem Types: n/a Description: getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline, as demonstrated by execute in Vim, and assert_fails or nvim_input in Neovim. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/numirias/security/blob/master/doc/2019-06-04_ace-vim-neovim.md - https://github.com/vim/vim/commit/53575521406739cf20bbe4e384d88e7dca11f040 - https://github.com/neovim/neovim/pull/10082 - https://bugs.debian.org
/commit/53575521406739cf20bbe4e384d88e7dca11f040 - https://github.com/neovim/neovim/pull/10082 - https://bugs.debian.org/930020 - https://bugs.debian.org/930024 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2BMDSHTF754TITC6AQJPCS5IRIDMMIM7/ - https://usn.ubuntu.com/4016-1/ - https://usn.ubuntu.com/4016-2/ - http://www.securityfocus.com/bid/108724 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TRIRBC2YRGKPAWVRMZS4SZTGGCVRVZPR/ - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00031.html - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00036.html - http://lists.
ounce/2019-06/msg00031.html - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00036.html - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00037.html - https://www.debian.org/security/2019/dsa-4467 - https://seclists.org/bugtraq/2019/Jun/33 - https://support.f5.com/csp/article/K93144355 - https://access.redhat.com/errata/RHSA-2019:1619 - https://access.redhat.com/errata/RHSA-2019:1774 - https://access.redhat.com/errata/RHSA-2019:1793 - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00034.html - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00050.html - https://www.debian.org/security/2019/dsa-4487 - https://seclists.org/bugtr
use-security-announce/2019-07/msg00050.html - https://www.debian.org/security/2019/dsa-4487 - https://seclists.org/bugtraq/2019/Jul/39 - https://access.redhat.com/errata/RHSA-2019:1947 - https://lists.debian.org/debian-lts-announce/2019/08/msg00003.html - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00075.html - https://support.f5.com/csp/article/K93144355?utm_source=f5support&amp;utm_medium=RSS - https://security.gentoo.org/glsa/202003-04 - https://www.exploit-db.com/exploits/46973
CVE ID: CVE-2019-12736 State: PUBLISHED Published: 2019-10-02T18:48:50 Last Updated: 2024-08-04T23:32:54.199Z Vendors: n/a Products: n/a Problem Types: n/a Description: JetBrains Ktor framework before 1.2.0-rc does not sanitize the username provided by the user for the LDAP protocol, leading to command injection. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com/blog/2019/09/26/jetbrains-security-bulletin-q2-2019/
CVE ID: CVE-2019-12737 State: PUBLISHED Published: 2019-10-02T18:47:48 Last Updated: 2024-08-04T23:32:54.199Z Vendors: n/a Products: n/a Problem Types: n/a Description: UserHashedTableAuth in JetBrains Ktor framework before 1.2.0-rc uses a One-Way Hash with a Predictable Salt for storing user credentials. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com/blog/2019/09/26/jetbrains-security-bulletin-q2-2019/
CVE ID: CVE-2019-12739 State: PUBLISHED Published: 2019-06-05T13:57:32 Last Updated: 2024-08-04T23:32:54.186Z Severity: CRITICAL (CVSS 9 CVSS:3.0/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: lib/Controller/ExtractionController.php in the Extract add-on before 1.2.0 for Nextcloud allows Remote Code Execution via shell metacharacters in a RAR filename via ajax/extractRar.php (nameOfFile and directory parameters). Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/546753 - https://www.secsignal.org/news/a-tale-of-rce-nextcloud-extract-app/
CVE ID: CVE-2019-12741 State: PUBLISHED Published: 2019-06-05T14:58:44 Last Updated: 2024-08-04T23:32:55.401Z Vendors: n/a Products: n/a Problem Types: n/a Description: XSS exists in the HAPI FHIR testpage overlay module of the HAPI FHIR library before 3.8.0. The attack involves unsanitized HTTP parameters being output in a form page, allowing attackers to leak cookies and other sensitive information from ca/uhn/fhir/to/BaseController.java via a specially crafted URL. (This module is not generally used in production systems so the attack surface is expected to be low, but affected systems are recommended to upgrade immediately.) Additional Analyst Notes: - CVE Program Container: References:
ffected systems are recommended to upgrade immediately.) Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jamesagnew/hapi-fhir/issues/1335 - https://github.com/jamesagnew/hapi-fhir/commit/8f41159eb147eeb964cad68b28eff97acac6ea9a - https://github.com/jamesagnew/hapi-fhir/releases/tag/v3.8.0
CVE ID: CVE-2019-12742 State: PUBLISHED Published: 2019-06-05T15:20:35 Last Updated: 2024-08-04T23:32:54.190Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bludit prior to 3.9.1 allows a non-privileged user to change the password of any account, including admin. This occurs because of bl-kernel/admin/controllers/user-password.php Insecure Direct Object Reference (a modified username POST parameter). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bludit/bludit/releases/tag/3.9.1 - https://github.com/bludit/bludit/commit/a1bb333153fa8ba29a88cfba423d810f509a2b37
CVE ID: CVE-2019-12743 State: PUBLISHED Published: 2019-07-29T15:23:27 Last Updated: 2024-08-04T23:32:54.792Z Vendors: n/a Products: n/a Problem Types: n/a Description: HumHub Social Network Kit Enterprise v1.3.13 allows remote attackers to find the user accounts existing on any Social Network Kits (including self-hosted ones) by brute-forcing the username after the /u/ initial URI substring, aka Response Discrepancy Information Exposure. Additional Analyst Notes: - CVE Program Container: References: - https://humhub.org/en/news - https://github.com/chanpu9/CVE/blob/master/2019-12743
CVE ID: CVE-2019-12744 State: PUBLISHED Published: 2019-06-20T16:26:15 Last Updated: 2024-08-04T23:32:54.177Z Vendors: n/a Products: n/a Problem Types: n/a Description: SeedDMS before 5.1.11 allows Remote Command Execution (RCE) because of unvalidated file upload of PHP scripts, a different vulnerability than CVE-2018-12940. Additional Analyst Notes: - CVE Program Container: References: - https://secfolks.blogspot.com/2019/06/exploit-for-cve-2019-12744-remote.html - https://sourceforge.net/p/seeddms/code/ci/master/tree/CHANGELOG - http://packetstormsecurity.com/files/153383/SeedDMS-Remote-Command-Execution.html - http://packetstormsecurity.com/files/163283/Seeddms-5.1.10-Remote-Command-Execu
/SeedDMS-Remote-Command-Execution.html - http://packetstormsecurity.com/files/163283/Seeddms-5.1.10-Remote-Command-Execution.html
CVE ID: CVE-2019-12745 State: PUBLISHED Published: 2019-06-20T16:29:24 Last Updated: 2024-08-04T23:32:54.818Z Vendors: n/a Products: n/a Problem Types: n/a Description: out/out.UsrMgr.php in SeedDMS before 5.1.11 allows Stored Cross-Site Scripting (XSS) via the name field. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/seeddms/code/ci/master/tree/CHANGELOG - https://secfolks.blogspot.com/2019/06/exploit-for-cve-2019-12745-stored-xss.html - http://packetstormsecurity.com/files/153382/SeedDMS-out.UsrMgr.php-Cross-Site-Scripting.html
CVE ID: CVE-2019-12746 State: PUBLISHED Published: 2019-08-21T00:00:00 Last Updated: 2024-08-04T23:32:54.650Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Open Ticket Request System (OTRS) Community Edition 5.0.x through 5.0.36 and 6.0.x through 6.0.19. A user logged into OTRS as an agent might unknowingly disclose their session ID by sharing the link of an embedded ticket article with third parties. This identifier can be then be potentially abused in order to impersonate the agent user. Additional Analyst Notes: - CVE Program Container: References: - https://www.otrs.com/category/release-and-security-notes-en/ - https://lists.debian.org/debian-lts-a
iner: References: - https://www.otrs.com/category/release-and-security-notes-en/ - https://lists.debian.org/debian-lts-announce/2019/08/msg00018.html - https://community.otrs.com/security-advisory-2019-10-security-update-for-otrs-framework/ - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html - http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html - http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html - https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html
CVE ID: CVE-2019-12747 State: PUBLISHED Published: 2019-07-09T14:13:24 Last Updated: 2024-08-04T23:32:55.166Z Vendors: n/a Products: n/a Problem Types: n/a Description: TYPO3 8.x through 8.7.26 and 9.x through 9.5.7 allows Deserialization of Untrusted Data. Additional Analyst Notes: - CVE Program Container: References: - https://typo3.org/security/advisory/typo3-core-sa-2019-020/
CVE ID: CVE-2019-12748 State: PUBLISHED Published: 2019-07-09T14:22:00 Last Updated: 2024-08-04T23:32:54.948Z Vendors: n/a Products: n/a Problem Types: n/a Description: TYPO3 8.3.0 through 8.7.26 and 9.0.0 through 9.5.7 allows XSS. Additional Analyst Notes: - CVE Program Container: References: - https://typo3.org/security/advisory/typo3-core-sa-2019-015/
CVE ID: CVE-2019-12749 State: PUBLISHED Published: 2019-06-11T16:11:45 Last Updated: 2024-12-06T13:09:22.768Z Vendors: n/a Products: n/a Problem Types: n/a Description: dbus before 1.10.28, 1.12.x before 1.12.16, and 1.13.x before 1.13.12, as used in DBusServer in Canonical Upstart in Ubuntu 14.04 (and in some, less common, uses of dbus-daemon), allows cookie spoofing because of symlink mishandling in the reference implementation of DBUS_COOKIE_SHA1 in the libdbus library. (This only affects the DBUS_COOKIE_SHA1 authentication mechanism.) A malicious client with write access to its own home directory could manipulate a ~/.dbus-keyrings symlink to cause a DBusServer with a different uid to re
s to its own home directory could manipulate a ~/.dbus-keyrings symlink to cause a DBusServer with a different uid to read and write in unintended locations. In the worst case, this could result in the DBusServer reusing a cookie that is known to the malicious client, and treating that cookie as evidence that a subsequent client connection came from an attacker-chosen uid, allowing authentication bypass. Additional Analyst Notes: - CVE Program Container: References: - https://www.openwall.com/lists/oss-security/2019/06/11/2 - http://www.openwall.com/lists/oss-security/2019/06/11/2 - https://usn.ubuntu.com/4015-1/ - https://usn.ubuntu.com/4015-2/ - https://www.debian.org/security/2019/dsa-446
06/11/2 - https://usn.ubuntu.com/4015-1/ - https://usn.ubuntu.com/4015-2/ - https://www.debian.org/security/2019/dsa-4462 - https://seclists.org/bugtraq/2019/Jun/16 - http://www.securityfocus.com/bid/108751 - https://lists.debian.org/debian-lts-announce/2019/06/msg00005.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V2CQF37O73VH2JDVX2ILX2KD2KLXLQOU/ - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00059.html - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00092.html - https://access.redhat.com/errata/RHSA-2019:1726 - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00026.html - https://
redhat.com/errata/RHSA-2019:1726 - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00026.html - https://security.gentoo.org/glsa/201909-08 - https://access.redhat.com/errata/RHSA-2019:2868 - https://access.redhat.com/errata/RHSA-2019:2870 - https://access.redhat.com/errata/RHSA-2019:3707
CVE ID: CVE-2019-12750 State: PUBLISHED Published: 2019-07-31T17:42:08 Last Updated: 2024-08-04T23:32:54.806Z Vendors: n/a Products: Symantec Endpoint Protection, Symantec Endpoint Protection Small Business Edition Problem Types: Privilege Escalation Description: Symantec Endpoint Protection, prior to 14.2 RU1 & 12.1 RU6 MP10 and Symantec Endpoint Protection Small Business Edition, prior to 12.1 RU6 MP10c (12.1.7491.7002), may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected from an application or user. Additional Analyst Note
on to gain elevated access to resources that are normally protected from an application or user. Additional Analyst Notes: - CVE Program Container: References: - https://support.symantec.com/us/en/article.SYMSA1487.html - http://packetstormsecurity.com/files/155581/Symantec-Endpoint-Protection-Information-Disclosure-Privilege-Escalation.html - http://seclists.org/fulldisclosure/2019/Dec/11 - http://seclists.org/fulldisclosure/2019/Dec/21
CVE ID: CVE-2019-12751 State: PUBLISHED Published: 2019-07-11T20:01:31 Last Updated: 2024-08-04T23:32:55.191Z Vendors: n/a Products: Symantec Messaging Gateway Problem Types: Privilege Escalation Description: Symantec Messaging Gateway, prior to 10.7.1, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected from an application or user. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/108925 - https://support.symantec.com/us/en/article.SYMSA1486.html
CVE ID: CVE-2019-12752 State: PUBLISHED Published: 2019-11-01T15:03:54 Last Updated: 2024-08-04T23:32:54.696Z Vendors: Symantec Products: SONAR Component Problem Types: Tamper Protection Bypass Description: The Symantec SONAR component, prior to 12.0.2, may be susceptible to a tamper protection bypass vulnerability which could potentially allow an attacker to circumvent the existing tamper protection in use on the resident system. Additional Analyst Notes: - CVE Program Container: References: - https://support.symantec.com/us/en/article.SYMSA1494.html
CVE ID: CVE-2019-12753 State: PUBLISHED Published: 2019-08-29T22:40:19 Last Updated: 2024-08-04T23:32:54.989Z Vendors: Symantec Corporation Products: Symantec Reporter Problem Types: Information disclosure Description: An information disclosure vulnerability in Symantec Reporter web UI 10.3 prior to 10.3.2.5 allows a malicious authenticated administrator user to obtain passwords for external SMTP, FTP, FTPS, LDAP, and Cloud Log Download servers that they might not otherwise be authorized to access. The malicious administrator user can also obtain the passwords of other Reporter web UI users. Additional Analyst Notes: - CVE Program Container: References: - https://support.symantec.com/us/en/a
rter web UI users. Additional Analyst Notes: - CVE Program Container: References: - https://support.symantec.com/us/en/article.SYMSA1489.html
CVE ID: CVE-2019-12754 State: PUBLISHED Published: 2019-08-29T22:27:48 Last Updated: 2024-08-04T23:32:54.862Z Vendors: Symantec Corporation Products: My VIP Portal Problem Types: Cross-site scripting Description: Symantec My VIP portal, previous version which has already been auto updated, was susceptible to a cross-site scripting (XSS) exploit, which is a type of issue that can enable attackers to inject client-side scripts into web pages viewed by other users or potentially bypass access controls such as the same-origin policy. Additional Analyst Notes: - CVE Program Container: References: - https://support.symantec.com/us/en/article.SYMSA1491.html
CVE ID: CVE-2019-12755 State: PUBLISHED Published: 2019-09-17T15:49:23 Last Updated: 2024-08-04T23:32:55.302Z Vendors: Symantec Corporation Products: Norton Password Manager Problem Types: Information Disclosure Description: Norton Password Manager, prior to 6.5.0.2104, may be susceptible to an information disclosure issue, which is a type of vulnerability whereby there is an unintentional disclosure of information to an actor that is not explicitly authorized to have access to that information. Additional Analyst Notes: - CVE Program Container: References: - https://support.symantec.com/us/en/article.SYMSA1493.html
CVE ID: CVE-2019-12756 State: PUBLISHED Published: 2019-11-15T16:58:23 Last Updated: 2024-08-04T23:32:55.148Z Vendors: n/a Products: Symantec Endpoint Protection (SEP) Problem Types: Password Protection Bypass Description: Symantec Endpoint Protection (SEP), prior to 14.2 RU2 may be susceptible to a password protection bypass vulnerability whereby the secondary layer of password protection could by bypassed for individuals with local administrator rights. Additional Analyst Notes: - CVE Program Container: References: - https://support.symantec.com/us/en/article.SYMSA1488.html
CVE ID: CVE-2019-12757 State: PUBLISHED Published: 2019-11-15T17:37:31 Last Updated: 2024-08-04T23:32:54.825Z Vendors: n/a Products: Symantec Endpoint Protection (SEP), Symantec Endpoint Protection Small Business Edition (SEP SBE) Problem Types: Privilege Escalation Description: Symantec Endpoint Protection (SEP), prior to 14.2 RU2 & 12.1 RU6 MP10 and Symantec Endpoint Protection Small Business Edition (SEP SBE) prior to 12.1 RU6 MP10d (12.1.7510.7002), may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected from an application o
mpromise the software application to gain elevated access to resources that are normally protected from an application or user. Additional Analyst Notes: - CVE Program Container: References: - https://support.symantec.com/us/en/article.SYMSA1488.html
CVE ID: CVE-2019-12758 State: PUBLISHED Published: 2019-11-15T17:37:43 Last Updated: 2024-08-04T23:32:54.895Z Vendors: n/a Products: Symantec Endpoint Protection Problem Types: Unsigned Code Execution Description: Symantec Endpoint Protection, prior to 14.2 RU2, may be susceptible to an unsigned code execution vulnerability, which may allow an individual to execute code without a resident proper digital signature. Additional Analyst Notes: - CVE Program Container: References: - https://support.symantec.com/us/en/article.SYMSA1488.html - https://safebreach.com/Post/Symantec-Endpoint-Protection-Self-Defense-Bypass-and-Potential-Usages-CVE-2019-12758
CVE ID: CVE-2019-12759 State: PUBLISHED Published: 2019-11-15T17:41:24 Last Updated: 2024-08-04T23:32:55.154Z Vendors: n/a Products: Symantec Endpoint Protection Manager (SEPM), Symantec Mail Security for MS Exchange (SMSMSE) Problem Types: Privilege Escalation Description: Symantec Endpoint Protection Manager (SEPM) and Symantec Mail Security for MS Exchange (SMSMSE), prior to versions 14.2 RU2 and 7.5.x respectively, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected from an application or user. Additional Analyst Notes: -
o gain elevated access to resources that are normally protected from an application or user. Additional Analyst Notes: - CVE Program Container: References: - https://support.symantec.com/us/en/article.SYMSA1488.html
CVE ID: CVE-2019-12760 State: PUBLISHED Published: 2019-06-06T18:55:03 Last Updated: 2024-08-04T23:32:54.763Z Vendors: n/a Products: n/a Problem Types: n/a Description: A deserialization vulnerability exists in the way parso through 0.4.0 handles grammar parsing from the cache. Cache loading relies on pickle and, provided that an evil pickle can be written to a cache grammar file and that its parsing can be triggered, this flaw leads to Arbitrary Code Execution. NOTE: This is disputed because "the cache directory is not under control of the attacker in any common configuration. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/d
ion. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/dhondta/f71ae7e5c4234f8edfd2f12503a5dcc7 - https://github.com/davidhalter/parso/issues/75