Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-16217 State: PUBLISHED Published: 2019-09-11T13:07:40 Last Updated: 2024-08-05T01:10:41.532Z Vendors: n/a Products: n/a Problem Types: n/a Description: WordPress before 5.2.3 allows XSS in media uploads because wp_ajax_upload_attachment is mishandled. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/news/2019/09/wordpress-5-2-3-security-and-maintenance-release/ - https://core.trac.wordpress.org/changeset/45936 - https://lists.debian.org/debian-lts-announce/2019/10/msg00023.html - https://seclists.org/bugtraq/2020/Jan/8 - https://www.debian.org/security/2020/dsa-4599 - https://www.debian.org/security/2020/dsa-4677
CVE ID: CVE-2019-16218 State: PUBLISHED Published: 2019-09-11T13:06:48 Last Updated: 2024-08-05T01:10:41.592Z Vendors: n/a Products: n/a Problem Types: n/a Description: WordPress before 5.2.3 allows XSS in stored comments. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/news/2019/09/wordpress-5-2-3-security-and-maintenance-release/ - https://wpvulndb.com/vulnerabilities/9861 - https://lists.debian.org/debian-lts-announce/2019/10/msg00023.html - https://seclists.org/bugtraq/2020/Jan/8 - https://www.debian.org/security/2020/dsa-4599 - https://www.debian.org/security/2020/dsa-4677
CVE ID: CVE-2019-16219 State: PUBLISHED Published: 2019-09-11T13:07:31 Last Updated: 2024-08-05T01:10:41.706Z Vendors: n/a Products: n/a Problem Types: n/a Description: WordPress before 5.2.3 allows XSS in shortcode previews. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/9864 - https://wordpress.org/news/2019/09/wordpress-5-2-3-security-and-maintenance-release/ - https://fortiguard.com/zeroday/FG-VD-18-165 - https://lists.debian.org/debian-lts-announce/2019/10/msg00023.html - https://seclists.org/bugtraq/2020/Jan/8 - https://www.debian.org/security/2020/dsa-4599 - https://www.debian.org/security/2020/dsa-4677
CVE ID: CVE-2019-16220 State: PUBLISHED Published: 2019-09-11T13:06:57 Last Updated: 2024-08-21T16:00:10.212812 Vendors: n/a Products: n/a Problem Types: n/a Description: In WordPress before 5.2.3, validation and sanitization of a URL in wp_validate_redirect in wp-includes/pluggable.php could lead to an open redirect if a provided URL path does not start with a forward slash. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/9863 - https://wordpress.org/news/2019/09/wordpress-5-2-3-security-and-maintenance-release/ - https://core.trac.wordpress.org/changeset/45971 - https://github.com/WordPress/WordPress/commit/c86ee39ff4c1a79b93c967eb88522
://core.trac.wordpress.org/changeset/45971 - https://github.com/WordPress/WordPress/commit/c86ee39ff4c1a79b93c967eb88522f5c09614a28 - https://lists.debian.org/debian-lts-announce/2019/10/msg00023.html - https://seclists.org/bugtraq/2020/Jan/8 - https://www.debian.org/security/2020/dsa-4599 - https://www.debian.org/security/2020/dsa-4677
CVE ID: CVE-2019-16221 State: PUBLISHED Published: 2019-09-11T13:07:23 Last Updated: 2024-08-05T01:10:41.472Z Vendors: n/a Products: n/a Problem Types: n/a Description: WordPress before 5.2.3 allows reflected XSS in the dashboard. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/9865 - https://wordpress.org/news/2019/09/wordpress-5-2-3-security-and-maintenance-release/ - https://lists.debian.org/debian-lts-announce/2019/10/msg00023.html - https://seclists.org/bugtraq/2020/Jan/8 - https://www.debian.org/security/2020/dsa-4599 - https://www.debian.org/security/2020/dsa-4677
CVE ID: CVE-2019-16222 State: PUBLISHED Published: 2019-09-11T13:07:15 Last Updated: 2024-08-05T01:10:41.572Z Vendors: n/a Products: n/a Problem Types: n/a Description: WordPress before 5.2.3 has an issue with URL sanitization in wp_kses_bad_protocol_once in wp-includes/kses.php that can lead to cross-site scripting (XSS) attacks. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/9867 - https://wordpress.org/news/2019/09/wordpress-5-2-3-security-and-maintenance-release/ - https://core.trac.wordpress.org/changeset/45997 - https://github.com/WordPress/WordPress/commit/30ac67579559fe42251b5a9f887211bf61a8ed68 - https://lists.debian.org/debian-
ttps://github.com/WordPress/WordPress/commit/30ac67579559fe42251b5a9f887211bf61a8ed68 - https://lists.debian.org/debian-lts-announce/2019/10/msg00023.html - https://seclists.org/bugtraq/2020/Jan/8 - https://www.debian.org/security/2020/dsa-4599 - https://www.debian.org/security/2020/dsa-4677
CVE ID: CVE-2019-16223 State: PUBLISHED Published: 2019-09-11T13:07:06 Last Updated: 2024-08-05T01:10:41.549Z Vendors: n/a Products: n/a Problem Types: n/a Description: WordPress before 5.2.3 allows XSS in post previews by authenticated users. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/9862 - https://wordpress.org/news/2019/09/wordpress-5-2-3-security-and-maintenance-release/ - https://lists.debian.org/debian-lts-announce/2019/10/msg00023.html - https://seclists.org/bugtraq/2020/Jan/8 - https://www.debian.org/security/2020/dsa-4599 - https://www.debian.org/security/2020/dsa-4677 - http://packetstormsecurity.com/files/160745/WordPress
ty/2020/dsa-4599 - https://www.debian.org/security/2020/dsa-4677 - http://packetstormsecurity.com/files/160745/WordPress-Core-5.2.2-Cross-Site-Scripting.html
CVE ID: CVE-2019-16224 State: PUBLISHED Published: 2019-09-11T14:47:37 Last Updated: 2024-08-05T01:10:41.557Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in py-lmdb 0.97. For certain values of md_flags, mdb_node_add does not properly set up a memcpy destination, leading to an invalid write operation. NOTE: this outcome occurs when accessing a data.mdb file supplied by an attacker. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TeamSeri0us/pocs/tree/master/lmdb/lmdb%20initialization%20vuln
CVE ID: CVE-2019-16225 State: PUBLISHED Published: 2019-09-11T14:47:23 Last Updated: 2024-08-05T01:10:41.679Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in py-lmdb 0.97. For certain values of mp_flags, mdb_page_touch does not properly set up mc->mc_pg[mc->top], leading to an invalid write operation. NOTE: this outcome occurs when accessing a data.mdb file supplied by an attacker. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TeamSeri0us/pocs/tree/master/lmdb/lmdb%20write%20to%20illegal%20address
CVE ID: CVE-2019-16226 State: PUBLISHED Published: 2019-09-11T14:47:13 Last Updated: 2024-08-05T01:10:41.670Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in py-lmdb 0.97. mdb_node_del does not validate a memmove in the case of an unexpected node->mn_hi, leading to an invalid write operation. NOTE: this outcome occurs when accessing a data.mdb file supplied by an attacker. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TeamSeri0us/pocs/tree/master/lmdb/lmdb%20memory%20corruption%20vuln
CVE ID: CVE-2019-16227 State: PUBLISHED Published: 2019-09-11T14:47:02 Last Updated: 2024-08-05T01:10:41.562Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in py-lmdb 0.97. For certain values of mn_flags, mdb_cursor_set triggers a memcpy with an invalid write operation within mdb_xcursor_init1. NOTE: this outcome occurs when accessing a data.mdb file supplied by an attacker. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TeamSeri0us/pocs/tree/master/lmdb/lmdb%20memcpy%20illegal%20dst
CVE ID: CVE-2019-16228 State: PUBLISHED Published: 2019-09-11T14:46:45 Last Updated: 2024-08-05T01:10:41.551Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in py-lmdb 0.97. There is a divide-by-zero error in the function mdb_env_open2 if mdb_env_read_header obtains a zero value for a certain size field. NOTE: this outcome occurs when accessing a data.mdb file supplied by an attacker. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TeamSeri0us/pocs/tree/master/lmdb/FPE
CVE ID: CVE-2019-16229 State: PUBLISHED Published: 2019-09-11T15:30:55 Last Updated: 2024-08-05T01:10:41.614Z Vendors: n/a Products: n/a Problem Types: n/a Description: drivers/gpu/drm/amd/amdkfd/kfd_interrupt.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value, leading to a NULL pointer dereference. NOTE: The security community disputes this issues as not being serious enough to be deserving a CVE id Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lkml.org/lkml/2019/9/9/487 - https://security.netapp.com/advisory/ntap-20191004-0001/ - https://bugzilla.suse.com/show_bug.cgi?id=1150469#c3 - https://usn.ubuntu.com/4285-1
.com/advisory/ntap-20191004-0001/ - https://bugzilla.suse.com/show_bug.cgi?id=1150469#c3 - https://usn.ubuntu.com/4285-1/ - https://usn.ubuntu.com/4287-1/ - https://usn.ubuntu.com/4287-2/ - https://usn.ubuntu.com/4284-1/
CVE ID: CVE-2019-16230 State: PUBLISHED Published: 2019-09-11T15:30:33 Last Updated: 2024-08-05T01:10:41.589Z Vendors: n/a Products: n/a Problem Types: n/a Description: drivers/gpu/drm/radeon/radeon_display.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value, leading to a NULL pointer dereference. NOTE: A third-party software maintainer states that the work queue allocation is happening during device initialization, which for a graphics card occurs during boot. It is not attacker controllable and OOM at that time is highly unlikely Additional Analyst Notes: - CVE Program Container: References: - https://lkml.org/lkml/2019/9/9/487 - https://security.netapp.com/advisor
t Notes: - CVE Program Container: References: - https://lkml.org/lkml/2019/9/9/487 - https://security.netapp.com/advisory/ntap-20191004-0001/ - https://bugzilla.suse.com/show_bug.cgi?id=1150468
CVE ID: CVE-2019-16231 State: PUBLISHED Published: 2019-09-11T15:30:23 Last Updated: 2024-08-05T01:10:41.646Z Vendors: n/a Products: n/a Problem Types: n/a Description: drivers/net/fjes/fjes_main.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value, leading to a NULL pointer dereference. Additional Analyst Notes: - CVE Program Container: References: - https://lkml.org/lkml/2019/9/9/487 - https://security.netapp.com/advisory/ntap-20191004-0001/ - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00035.html - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00039.html - https://usn.ubuntu.com/4227-1/ - https://usn.ubuntu.com/4226-1/ - https:
nsuse-security-announce/2019-11/msg00039.html - https://usn.ubuntu.com/4227-1/ - https://usn.ubuntu.com/4226-1/ - https://usn.ubuntu.com/4225-1/ - https://usn.ubuntu.com/4227-2/ - https://usn.ubuntu.com/4225-2/
CVE ID: CVE-2019-16232 State: PUBLISHED Published: 2019-09-11T15:30:13 Last Updated: 2024-08-05T01:10:41.560Z Vendors: n/a Products: n/a Problem Types: n/a Description: drivers/net/wireless/marvell/libertas/if_sdio.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value, leading to a NULL pointer dereference. Additional Analyst Notes: - CVE Program Container: References: - https://lkml.org/lkml/2019/9/9/487 - https://security.netapp.com/advisory/ntap-20191004-0001/ - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00064.html - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00010.html - https://lists.fedoraproject.org/archives/list/package
ts.opensuse.org/opensuse-security-announce/2019-11/msg00010.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LYIFGYEDQXP5DVJQQUARQRK2PXKBKQGY/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YWWOOJKZ4NQYN4RMFIVJ3ZIXKJJI3MKP/ - https://usn.ubuntu.com/4285-1/ - https://usn.ubuntu.com/4287-1/ - https://usn.ubuntu.com/4287-2/ - https://usn.ubuntu.com/4284-1/
CVE ID: CVE-2019-16233 State: PUBLISHED Published: 2019-09-11T15:30:01 Last Updated: 2024-08-05T01:10:41.666Z Vendors: n/a Products: n/a Problem Types: n/a Description: drivers/scsi/qla2xxx/qla_os.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value, leading to a NULL pointer dereference. Additional Analyst Notes: - CVE Program Container: References: - https://lkml.org/lkml/2019/9/9/487 - https://security.netapp.com/advisory/ntap-20191004-0001/ - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00010.html - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00035.html - https://usn.ubuntu.com/4227-1/ - https://usn.ubuntu.com/4226-1/ - https
ensuse-security-announce/2019-11/msg00035.html - https://usn.ubuntu.com/4227-1/ - https://usn.ubuntu.com/4226-1/ - https://usn.ubuntu.com/4227-2/ - https://usn.ubuntu.com/4346-1/
CVE ID: CVE-2019-16234 State: PUBLISHED Published: 2019-09-11T15:29:40 Last Updated: 2024-08-05T01:10:41.706Z Vendors: n/a Products: n/a Problem Types: n/a Description: drivers/net/wireless/intel/iwlwifi/pcie/trans.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value, leading to a NULL pointer dereference. Additional Analyst Notes: - CVE Program Container: References: - https://lkml.org/lkml/2019/9/9/487 - https://security.netapp.com/advisory/ntap-20191004-0001/ - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00064.html - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00010.html - https://usn.ubuntu.com/4344-1/ - https://usn.ubuntu.c
ts.opensuse.org/opensuse-security-announce/2019-11/msg00010.html - https://usn.ubuntu.com/4344-1/ - https://usn.ubuntu.com/4345-1/ - https://usn.ubuntu.com/4342-1/ - https://usn.ubuntu.com/4346-1/
CVE ID: CVE-2019-16235 State: PUBLISHED Published: 2019-09-11T18:57:20 Last Updated: 2024-08-05T01:10:41.635Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dino before 2019-09-10 does not properly check the source of a carbons message in module/xep/0280_message_carbons.vala. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dino/dino/commit/e84f2c49567e86d2a261ea264d65c4adc549c930 - https://gultsch.de/dino_multiple.html - http://www.openwall.com/lists/oss-security/2019/09/12/5 - https://seclists.org/bugtraq/2019/Sep/31 - https://www.debian.org/security/2019/dsa-4524 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorap
//www.debian.org/security/2019/dsa-4524 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YUBM7GDZBB6MZZALDWYRAPNV6HJNLNMC/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5TMGQ5Q6QMIFG4NVUWMOWW3GIPGWQZVF/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WZBNQAOBWTIOKNO4PIYNX624ACGUXSXQ/ - https://usn.ubuntu.com/4306-1/
CVE ID: CVE-2019-16236 State: PUBLISHED Published: 2019-09-11T18:57:07 Last Updated: 2024-08-05T01:10:41.661Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dino before 2019-09-10 does not check roster push authorization in module/roster/module.vala. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dino/dino/commit/dd33f5f949248d87d34f399e8846d5ee5b8823d9 - https://gultsch.de/dino_multiple.html - http://www.openwall.com/lists/oss-security/2019/09/12/5 - https://seclists.org/bugtraq/2019/Sep/31 - https://www.debian.org/security/2019/dsa-4524 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YUBM7GD
2019/dsa-4524 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YUBM7GDZBB6MZZALDWYRAPNV6HJNLNMC/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5TMGQ5Q6QMIFG4NVUWMOWW3GIPGWQZVF/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WZBNQAOBWTIOKNO4PIYNX624ACGUXSXQ/ - https://usn.ubuntu.com/4306-1/
CVE ID: CVE-2019-16237 State: PUBLISHED Published: 2019-09-11T18:56:58 Last Updated: 2024-08-05T01:10:41.650Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dino before 2019-09-10 does not properly check the source of an MAM message in module/xep/0313_message_archive_management.vala. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dino/dino/commit/307f16cc86dd2b95aa02ab8a85110e4a2d5e7363 - https://gultsch.de/dino_multiple.html - http://www.openwall.com/lists/oss-security/2019/09/12/5 - https://seclists.org/bugtraq/2019/Sep/31 - https://www.debian.org/security/2019/dsa-4524 - https://lists.fedoraproject.org/archives/list/package-announce%40lists
- https://www.debian.org/security/2019/dsa-4524 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YUBM7GDZBB6MZZALDWYRAPNV6HJNLNMC/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5TMGQ5Q6QMIFG4NVUWMOWW3GIPGWQZVF/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WZBNQAOBWTIOKNO4PIYNX624ACGUXSXQ/ - https://usn.ubuntu.com/4306-1/
CVE ID: CVE-2019-16238 State: PUBLISHED Published: 2019-09-12T15:53:03 Last Updated: 2024-08-05T01:10:41.643Z Vendors: n/a Products: n/a Problem Types: n/a Description: Afterlogic Aurora through 8.3.9-build-a3 has XSS that can be leveraged for session hijacking by retrieving the session cookie from the administrator login. Additional Analyst Notes: - CVE Program Container: References: - https://www.sevenlayers.com/index.php/247-afterlogic-aurora-v8-3-9-build-a3-xss-session-hijack
CVE ID: CVE-2019-16239 State: PUBLISHED Published: 2019-09-17T11:37:21 Last Updated: 2024-08-05T01:10:41.727Z Vendors: n/a Products: n/a Problem Types: n/a Description: process_http_response in OpenConnect before 8.05 has a Buffer Overflow when a malicious server uses HTTP chunked encoding with crafted chunk sizes. Additional Analyst Notes: - CVE Program Container: References: - https://t2.fi/schedule/2019/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WI7ZENFAWCHF2RU4NHPL2CU4WGZ4BNDJ/ - http://lists.infradead.org/pipermail/openconnect-devel/2019-September/005412.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists
il/openconnect-devel/2019-September/005412.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HDMZGNBLZZKAGBI2PNXYWWKLD2LXKFH6/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FX56KYWC7X4ETV4P6HGJC7GZUEBITBBS/ - https://lists.debian.org/debian-lts-announce/2019/10/msg00003.html - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00060.html - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00061.html - https://www.debian.org/security/2020/dsa-4607 - https://seclists.org/bugtraq/2020/Jan/31 - https://usn.ubuntu.com/4565-1/
CVE ID: CVE-2019-16240 State: PUBLISHED Published: 2021-11-09T14:37:36 Last Updated: 2024-08-05T01:10:41.632Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Buffer Overflow and Information Disclosure issue exists in HP OfficeJet Pro Printers before 001.1937C, and HP PageWide Managed Printers and HP PageWide Pro Printers before 001.1937D exists; A maliciously crafted print file might cause certain HP Inkjet printers to assert. Under certain circumstances, the printer produces a core dump to a local device. Additional Analyst Notes: - CVE Program Container: References: - https://support.hp.com/us-en/document/c06458150
CVE ID: CVE-2019-16241 State: PUBLISHED Published: 2019-11-26T15:33:26 Last Updated: 2024-08-05T01:10:41.583Z Vendors: n/a Products: n/a Problem Types: n/a Description: On TCL Alcatel Cingular Flip 2 B9HUAH1 devices, PIN authentication can be bypassed by creating a special file within the /data/local/tmp/ directory. The System application that implements the lock screen checks for the existence of a specific file and disables PIN authentication if it exists. This file would typically be created via Android Debug Bridge (adb) over USB. Additional Analyst Notes: - CVE Program Container: References: - https://www.nccgroup.trust/uk/our-research/?research=Technical+advisories - https://www.nccgro
Container: References: - https://www.nccgroup.trust/uk/our-research/?research=Technical+advisories - https://www.nccgroup.trust/us/our-research/technical-advisory-multiple-vulnerabilities-in-alcatel-flip-2/#C
CVE ID: CVE-2019-16242 State: PUBLISHED Published: 2019-11-26T15:30:15 Last Updated: 2024-08-05T01:10:41.809Z Vendors: n/a Products: n/a Problem Types: n/a Description: On TCL Alcatel Cingular Flip 2 B9HUAH1 devices, there is an engineering application named omamock that is vulnerable to OS command injection. An attacker with physical access to the device can abuse this vulnerability to execute arbitrary OS commands as the root user via the application's UI. Additional Analyst Notes: - CVE Program Container: References: - https://www.nccgroup.trust/uk/our-research/?research=Technical+advisories - https://www.nccgroup.trust/us/our-research/technical-advisory-multiple-vulnerabilities-in-alcate
=Technical+advisories - https://www.nccgroup.trust/us/our-research/technical-advisory-multiple-vulnerabilities-in-alcatel-flip-2/
CVE ID: CVE-2019-16243 State: PUBLISHED Published: 2019-11-26T15:31:38 Last Updated: 2024-08-05T01:10:41.662Z Vendors: n/a Products: n/a Problem Types: n/a Description: On TCL Alcatel Cingular Flip 2 B9HUAH1 devices, there is an undocumented web API that allows unprivileged JavaScript, including JavaScript running within the KaiOS browser, to view and edit the device's firmware over-the-air update settings. (This web API is normally used by the system application to trigger firmware updates via OmaService.js.) Additional Analyst Notes: - CVE Program Container: References: - https://www.nccgroup.trust/uk/our-research/?research=Technical+advisories - https://www.nccgroup.trust/us/our-research/
https://www.nccgroup.trust/uk/our-research/?research=Technical+advisories - https://www.nccgroup.trust/us/our-research/technical-advisory-multiple-vulnerabilities-in-alcatel-flip-2/#B
CVE ID: CVE-2019-16244 State: PUBLISHED Published: 2020-07-22T15:31:29 Last Updated: 2024-08-05T01:10:41.665Z Vendors: n/a Products: n/a Problem Types: n/a Description: OMERO.server before 5.6.1 allows attackers to bypass the security filters and access hidden objects via a crafted query. Additional Analyst Notes: - CVE Program Container: References: - https://www.openmicroscopy.org/security/advisories/2019-SV5/
CVE ID: CVE-2019-16245 State: PUBLISHED Published: 2020-06-17T16:18:19 Last Updated: 2024-08-05T01:10:41.628Z Vendors: n/a Products: n/a Problem Types: n/a Description: OMERO before 5.6.1 makes the details of each user available to all users. Additional Analyst Notes: - CVE Program Container: References: - https://www.openmicroscopy.org/security/advisories/2019-SV3/
CVE ID: CVE-2019-16246 State: PUBLISHED Published: 2019-12-12T13:43:33 Last Updated: 2024-08-05T01:10:41.594Z Vendors: n/a Products: n/a Problem Types: n/a Description: Intesync Solismed 3.3sp1 allows Local File Inclusion (LFI), a different vulnerability than CVE-2019-15931. This leads to unauthenticated code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.solismed.com/ - https://know.bishopfox.com/advisories - https://know.bishopfox.com/advisories/solismed-critical
CVE ID: CVE-2019-16247 State: PUBLISHED Published: 2019-09-11T21:23:36 Last Updated: 2024-08-05T01:10:41.593Z Vendors: n/a Products: n/a Problem Types: n/a Description: Delta DCISoft 1.21 has a User Mode Write AV starting at CommLib!CCommLib::SetSerializeData+0x000000000000001b. Additional Analyst Notes: - CVE Program Container: References: - https://code610.blogspot.com/2019/09/crashing-dcisoft-121.html