Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-17071 State: PUBLISHED Published: 2019-10-10T10:51:54 Last Updated: 2024-08-05T01:33:16.406Z Vendors: n/a Products: n/a Problem Types: n/a Description: The client-dash (aka Client Dash) plugin 2.1.4 for WordPress allows XSS. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/client-dash/#developers - https://gist.github.com/rezaduty/18afedba24bb1e5835010bd2de67cece
CVE ID: CVE-2019-17072 State: PUBLISHED Published: 2019-10-10T10:52:22 Last Updated: 2024-08-05T01:33:16.798Z Vendors: n/a Products: n/a Problem Types: n/a Description: The new-contact-form-widget (aka Contact Form Widget - Contact Query, Form Maker) plugin 1.0.9 for WordPress has SQL Injection via all-query-page.php. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/new-contact-form-widget/#description - https://gist.github.com/rezaduty/18afedba24bb1e5835010bd2de67cece
CVE ID: CVE-2019-17073 State: PUBLISHED Published: 2019-10-01T19:06:54 Last Updated: 2024-08-05T01:33:16.953Z Vendors: n/a Products: n/a Problem Types: n/a Description: emlog through 6.0.0beta allows remote authenticated users to delete arbitrary files via admin/template.php?action=del&tpl=../ directory traversal. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/emlog/emlog/issues/49
CVE ID: CVE-2019-17074 State: PUBLISHED Published: 2019-10-01T19:06:42 Last Updated: 2024-08-05T01:33:16.680Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in XunRuiCMS 4.3.1. There is a stored XSS in the module_category area. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dayrui/xunruicms/issues/2
CVE ID: CVE-2019-17075 State: PUBLISHED Published: 2019-10-01T20:07:51 Last Updated: 2024-08-05T01:33:17.234Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in write_tpt_entry in drivers/infiniband/hw/cxgb4/mem.c in the Linux kernel through 5.3.2. The cxgb4 driver is directly calling dma_map_single (a DMA function) from a stack variable. This could allow an attacker to trigger a Denial of Service, exploitable if this driver is used on an architecture for which this stack/DMA interaction has security relevance. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/bugtraq/2019/Nov/11 - https://usn.ubuntu.com/4211-2/ - https:/
CVE Program Container: References: - https://seclists.org/bugtraq/2019/Nov/11 - https://usn.ubuntu.com/4211-2/ - https://usn.ubuntu.com/4208-1/ - https://usn.ubuntu.com/4210-1/ - https://usn.ubuntu.com/4211-1/ - https://usn.ubuntu.com/4226-1/ - https://lists.debian.org/debian-lts-announce/2020/03/msg00001.html - https://www.oracle.com/security-alerts/cpuApr2021.html - http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html - https://lore.kernel.org/lkml/20191001165611.GA3542072%40kroah.com
CVE ID: CVE-2019-17076 State: PUBLISHED Published: 2020-01-08T15:57:07 Last Updated: 2024-08-05T01:33:16.508Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Jamf Pro 9.x and 10.x before 10.15.1. Deserialization of untrusted data when parsing JSON in several APIs may cause Denial of Service (DoS), remote code execution (RCE), and/or deletion of files on the Jamf Pro server. Additional Analyst Notes: - CVE Program Container: References: - https://resources.jamf.com/documents/products/security-disclosure-notice-jamf-pro-10.15.1.pdf
CVE ID: CVE-2019-17080 State: PUBLISHED Published: 2019-10-02T12:17:42 Last Updated: 2024-08-05T01:33:17.296Z Vendors: n/a Products: n/a Problem Types: n/a Description: mintinstall (aka Software Manager) 7.9.9 for Linux Mint allows code execution if a REVIEWS_CACHE file is controlled by an attacker, because an unpickle occurs. This is resolved in 8.0.0 and backports. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Andhrimnirr/Mintinstall-object-injection - https://github.com/linuxmint/mintinstall/blob/master/debian/changelog - http://packetstormsecurity.com/files/154722/mintinstall-7.9.9-Code-Execution.html - https://forums.linuxmint.com/viewtopic.php?f=14
etstormsecurity.com/files/154722/mintinstall-7.9.9-Code-Execution.html - https://forums.linuxmint.com/viewtopic.php?f=143&t=302960
CVE ID: CVE-2019-17082 State: PUBLISHED Published: 2024-11-26T19:31:57.665Z Last Updated: 2024-12-17T15:51:44.734Z Vendors: OpenText™ Products: AccuRev Problem Types: CWE-522 Description: Insufficiently Protected Credentials vulnerability in OpenText™ AccuRev allows Authentication Bypass. When installed on a Linux or Solaris system the vulnerability could allow anyone who knows a valid AccuRev username can use the AccuRev client to login and gain access to AccuRev source control without knowing the user’s password. This issue affects AccuRev: 2017.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.microfocus.com/kb/kmdoc.php?id=KM03544106
CVE ID: CVE-2019-17085 State: PUBLISHED Published: 2019-11-18T20:16:28 Last Updated: 2024-08-05T01:33:16.729Z Vendors: Micro Focus International Products: Operations Agent Problem Types: XXE attack Description: XXE attack vulnerability on Micro Focus Operations Agent, affected version 12.0, 12.01, 12.02, 12.03, 12.04, 12.05, 12.06, 12.10, 12.11. The vulnerability could be exploited to do an XXE attack on Operations Agent. Additional Analyst Notes: - CVE Program Container: References: - https://softwaresupport.softwaregrp.com/doc/KM03556426
CVE ID: CVE-2019-17087 State: PUBLISHED Published: 2019-12-11T22:11:30 Last Updated: 2024-08-05T01:33:16.562Z Vendors: Micro Focus International Products: AcuToWeb Problem Types: Unauthorized file download. Description: Unauthorized file download vulnerability in all supported versions of Micro Focus AcuToWeb. The vulnerability could be exploited to enumerate and download files from the filesystem of the system running AcuToWeb, with the privileges of the account AcuToWeb is running under. Additional Analyst Notes: - CVE Program Container: References: - https://softwaresupport.softwaregrp.com/doc/KM03569662
CVE ID: CVE-2019-17091 State: PUBLISHED Published: 2019-10-02T13:58:49 Last Updated: 2024-08-05T01:33:16.741Z Vendors: n/a Products: n/a Problem Types: n/a Description: faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces before 2.2.20, allows Reflected XSS because a client window field is mishandled. Additional Analyst Notes: - CVE Program Container: References: - https://www.oracle.com/security-alerts/cpuapr2020.html - https://www.oracle.com/security-alerts/cpujul2020.html - https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html - https://www.oracle.com/security-alerts/cpujan2020.h
w.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html - https://www.oracle.com/security-alerts/cpujan2020.html - https://bugs.eclipse.org/bugs/show_bug.cgi?id=548244 - https://github.com/eclipse-ee4j/mojarra/pull/4567 - https://github.com/eclipse-ee4j/mojarra/issues/4556 - https://github.com/eclipse-ee4j/mojarra/files/3039198/advisory.txt - https://github.com/eclipse-ee4j/mojarra/compare/2.3.9-RELEASE...2.3.10-RELEASE - https://github.com/eclipse-ee4j/mojarra/commit/8f70f2bd024f00ecd5b3dcca45df73edda29dcee - https://github.com/eclipse-ee4j/mojarra/commit/a3fa9573789ed5e867c43ea38374f4dbd5a8f81f - https://github.com/javaserverfaces/mojarra/compare/2.2.19...2.2.20 - https://github
73789ed5e867c43ea38374f4dbd5a8f81f - https://github.com/javaserverfaces/mojarra/compare/2.2.19...2.2.20 - https://github.com/javaserverfaces/mojarra/commit/ae1c234d0a6750822ac69d4ae26d90e3571f27fe - https://github.com/javaserverfaces/mojarra/commit/f61935cd39f34329fbf27b1972a506fbdd0ab4d4 - https://www.oracle.com/security-alerts/cpuoct2020.html - https://www.oracle.com/security-alerts/cpujan2021.html - https://www.oracle.com/security-alerts/cpujan2022.html
CVE ID: CVE-2019-17092 State: PUBLISHED Published: 2019-10-09T18:22:45 Last Updated: 2024-08-05T01:33:16.898Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XSS vulnerability in project list in OpenProject before 9.0.4 and 10.x before 10.0.2 allows remote attackers to inject arbitrary web script or HTML via the sortBy parameter because error messages are mishandled. Additional Analyst Notes: - CVE Program Container: References: - https://www.openproject.org/release-notes/openproject-10-0-2/ - https://www.openproject.org/release-notes/openproject-9-0-4/ - https://groups.google.com/forum/#%21topic/openproject-security/tEsx0UXWxXA - http://seclists.org/fulldisclosure/2019/Oct/29
s://groups.google.com/forum/#%21topic/openproject-security/tEsx0UXWxXA - http://seclists.org/fulldisclosure/2019/Oct/29 - https://seclists.org/bugtraq/2019/Oct/19 - http://packetstormsecurity.com/files/154851/OpenProject-10.0.1-9.0.3-Cross-Site-Scripting.html
CVE ID: CVE-2019-17093 State: PUBLISHED Published: 2019-10-23T16:59:08 Last Updated: 2024-08-05T01:33:16.465Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Avast antivirus before 19.8 and AVG antivirus before 19.8. A DLL Preloading vulnerability allows an attacker to implant %WINDIR%\system32\wbemcomn.dll, which is loaded into a protected-light process (PPL) and might bypass some of the self-defense mechanisms. This affects all components that use WMI, e.g., AVGSvc.exe 19.6.4546.0 and TuneupSmartScan.dll 19.1.884.0. Additional Analyst Notes: - CVE Program Container: References: - https://safebreach.com/blog - https://safebreach.com/Post/Avast-Antivirus
Notes: - CVE Program Container: References: - https://safebreach.com/blog - https://safebreach.com/Post/Avast-Antivirus-AVG-Antivirus-DLL-Preloading-into-PPL-and-Potential-Abuses
CVE ID: CVE-2019-17094 State: PUBLISHED Published: 2020-01-27T17:14:09.103326Z Last Updated: 2024-09-16T22:34:52.643Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Belkin Products: Belkin WeMo Insight Switch Problem Types: CWE-121 Description: A Stack-based Buffer Overflow vulnerability in libbelkin_api.so component of Belkin WeMo Insight Switch firmware allows a local attacker to obtain code execution on the device. This issue affects: Belkin WeMo Insight Switch firmware version 2.00.11396 and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://labs.bitdefender.com/2019/12/multiple-vulnerabilities-in-belkin-wemo-insight-
E Program Container: References: - https://labs.bitdefender.com/2019/12/multiple-vulnerabilities-in-belkin-wemo-insight-switch/
CVE ID: CVE-2019-17095 State: PUBLISHED Published: 2020-01-27T17:20:14.173293Z Last Updated: 2024-09-17T01:36:07.424Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Bitdefender Products: Bitdefender BOX 2 Problem Types: CWE-78 Description: A command injection vulnerability has been discovered in the bootstrap stage of Bitdefender BOX 2, versions 2.1.47.42 and 2.1.53.45. The API method `/api/download_image` unsafely handles the production firmware URL supplied by remote servers, leading to arbitrary execution of system commands. In order to exploit the condition, an unauthenticated attacker should impersonate a infrastructure server to trigger this vulnerabili
xploit the condition, an unauthenticated attacker should impersonate a infrastructure server to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.bitdefender.com/support/security-advisories/command-injection-vulnerability-in-bitdefender-box-v2-va-5706
CVE ID: CVE-2019-17096 State: PUBLISHED Published: 2020-01-28T13:39:04.353142Z Last Updated: 2024-09-17T02:22:08.732Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Bitdefender Products: Bitdefender BOX 2 Problem Types: CWE-78 Description: A OS Command Injection vulnerability in the bootstrap stage of Bitdefender BOX 2 allows the manipulation of the `get_image_url()` function in special circumstances to inject a system command. Additional Analyst Notes: - CVE Program Container: References: - https://www.bitdefender.com/support/security-advisories/bitdefender-box-2-bootstrap-get_image_size-command-injection-vulnerability/
CVE ID: CVE-2019-17098 State: PUBLISHED Published: 2020-09-30T13:05:16.276620Z Last Updated: 2024-09-17T03:28:08.464Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: August Products: Smart Lock and Connect Wi-Fi Bridge App, Connect Firmware Problem Types: CWE-321 Description: Use of hard-coded cryptographic key vulnerability in August Connect Wi-Fi Bridge App, Connect Firmware allows an attacker to decrypt an intercepted payload containing the Wi-Fi network authentication credentials. This issue affects: August Connect Wi-Fi Bridge App version v10.11.0 and prior versions on Android. August Connect Firmware version 2.2.12 and prior versions. Additional Analyst N
v10.11.0 and prior versions on Android. August Connect Firmware version 2.2.12 and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://labs.bitdefender.com/2020/08/smart-locks-not-so-smart-with-wi-fi-security/
CVE ID: CVE-2019-17099 State: PUBLISHED Published: 2020-01-27T17:23:06.763797Z Last Updated: 2024-09-16T17:02:47.446Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:L) Vendors: Bitdefender Products: EPSecurityService.exe Problem Types: CWE-426 Description: An Untrusted Search Path vulnerability in EPSecurityService.exe as used in Bitdefender Endpoint Security Tools versions prior to 6.6.11.163 allows an attacker to load an arbitrary DLL file from the search path. This issue affects: Bitdefender EPSecurityService.exe versions prior to 6.6.11.163. Additional Analyst Notes: - CVE Program Container: References: - https://www.bitdefender.com/support/security-advisories/untr
ional Analyst Notes: - CVE Program Container: References: - https://www.bitdefender.com/support/security-advisories/untrusted-search-path-vulnerability-epsecurityservice-exe-va-3500/
CVE ID: CVE-2019-17100 State: PUBLISHED Published: 2020-01-27T13:55:17.731390Z Last Updated: 2024-09-17T03:17:55.533Z Severity: MEDIUM (CVSS 5.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Bitdefender Products: bdserviceshost.exe Problem Types: CWE-426 Description: An Untrusted Search Path vulnerability in bdserviceshost.exe as used in Bitdefender Total Security 2020 allows an attacker to execute arbitrary code. This issue does not affect: Bitdefender Total Security versions prior to 24.0.12.69. Additional Analyst Notes: - CVE Program Container: References: - https://www.bitdefender.com/support/security-advisories/untrusted-search-path-vulnerability-bitdefender-total-security-2020
ps://www.bitdefender.com/support/security-advisories/untrusted-search-path-vulnerability-bitdefender-total-security-2020-va-5895/
CVE ID: CVE-2019-17101 State: PUBLISHED Published: 2020-04-23T18:35:12.264331Z Last Updated: 2024-09-17T03:43:24.851Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L) Vendors: Netatmo Products: Smart Indoor Camera Problem Types: CWE-77 Description: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in firmware versions prior to x.xx of Netatmo Smart Indoor Camera allows an attacker to execute commands on the device. This issue affects: Netatmo Smart Indoor Camera version and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://labs.bitdefender.com/2020/04/cracking-the-netatmo-smart-indo
alyst Notes: - CVE Program Container: References: - https://labs.bitdefender.com/2020/04/cracking-the-netatmo-smart-indoor-security-camera/
CVE ID: CVE-2019-17102 State: PUBLISHED Published: 2020-01-27T14:05:23.586602Z Last Updated: 2024-09-17T03:59:40.500Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Bitdefender Products: Bitdefender BOX 2 Problem Types: CWE-413 Description: An exploitable command execution vulnerability exists in the recovery partition of Bitdefender BOX 2, version 2.0.1.91. The API method `/api/update_setup` does not perform firmware signature checks atomically, leading to an exploitable race condition (TOCTTOU) that allows arbitrary execution of system commands. This issue affects: Bitdefender Bitdefender BOX 2 versions prior to 2.1.47.36. Additional Analyst Notes: - CVE Pr
mands. This issue affects: Bitdefender Bitdefender BOX 2 versions prior to 2.1.47.36. Additional Analyst Notes: - CVE Program Container: References: - https://www.bitdefender.com/support/security-advisories/bitdefender-box-v2-bootstrap-update_setup-command-execution-vulnerability-va-2226
CVE ID: CVE-2019-17103 State: PUBLISHED Published: 2020-01-27T14:10:17.721075Z Last Updated: 2024-09-16T19:09:06.678Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N) Vendors: Bitdefender Products: Bitdefender AV for Mac Problem Types: CWE-276 Description: An Incorrect Default Permissions vulnerability in the BDLDaemon component of Bitdefender AV for Mac allows an attacker to elevate permissions to read protected directories. This issue affects: Bitdefender AV for Mac versions prior to 8.0.0. Additional Analyst Notes: - CVE Program Container: References: - https://www.bitdefender.com/support/security-advisories/get-task-allow-entitlement-via-bdldaemon-macos-va-3448/
CVE ID: CVE-2019-17104 State: PUBLISHED Published: 2019-10-08T12:19:30 Last Updated: 2024-08-05T01:33:17.139Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Centreon VM through 19.04.3, the cookie configuration within the Apache HTTP Server does not protect against theft because the HTTPOnly flag is not set. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/centreon/centreon/issues/7097 - https://www.openwall.com/lists/oss-security/2019/10/08/1 - http://www.openwall.com/lists/oss-security/2019/10/09/2
CVE ID: CVE-2019-17105 State: PUBLISHED Published: 2019-10-08T14:35:17 Last Updated: 2024-08-05T01:33:16.552Z Vendors: n/a Products: n/a Problem Types: n/a Description: The token generator in index.php in Centreon Web before 2.8.27 is predictable. Additional Analyst Notes: - CVE Program Container: References: - https://www.openwall.com/lists/oss-security/2019/10/08/1 - https://github.com/centreon/centreon/pull/7100 - http://www.openwall.com/lists/oss-security/2019/10/09/2
CVE ID: CVE-2019-17106 State: PUBLISHED Published: 2019-10-08T12:21:04 Last Updated: 2024-08-05T01:33:16.598Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Centreon Web through 2.8.29, disclosure of external components' passwords allows authenticated attackers to move laterally to external components. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/centreon/centreon/issues/7098 - https://www.openwall.com/lists/oss-security/2019/10/08/1 - http://www.openwall.com/lists/oss-security/2019/10/09/2
CVE ID: CVE-2019-17107 State: PUBLISHED Published: 2019-10-08T12:24:04 Last Updated: 2024-08-05T01:33:16.612Z Vendors: n/a Products: n/a Problem Types: n/a Description: minPlayCommand.php in Centreon Web before 2.8.27 allows authenticated attackers to execute arbitrary code via the command_hostaddress parameter. NOTE: some sources have listed CVE-2019-17017 for this, but that is incorrect. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/centreon/centreon/pull/7099 - https://www.openwall.com/lists/oss-security/2019/10/08/1 - http://www.openwall.com/lists/oss-security/2019/10/09/2
CVE ID: CVE-2019-17108 State: PUBLISHED Published: 2019-10-08T12:25:07 Last Updated: 2024-08-05T01:33:17.279Z Vendors: n/a Products: n/a Problem Types: n/a Description: Local file inclusion in brokerPerformance.php in Centreon Web before 2.8.28 allows attackers to disclose information or perform a stored XSS attack on a user. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/centreon/centreon/pull/7101 - https://www.openwall.com/lists/oss-security/2019/10/08/1 - http://www.openwall.com/lists/oss-security/2019/10/09/2
CVE ID: CVE-2019-17109 State: PUBLISHED Published: 2019-10-09T21:30:22 Last Updated: 2024-08-05T01:33:17.315Z Vendors: n/a Products: n/a Problem Types: n/a Description: Koji through 1.18.0 allows remote Directory Traversal, with resultant Privilege Escalation. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/10/09/5 - https://docs.pagure.org/koji/CVE-2019-17109/ - https://pagure.io/koji/commits/master - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7PSCCFHLNVFLDPC7DB4UJGXD6ZWBSY57/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message
DPC7DB4UJGXD6ZWBSY57/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4BGUXMZIAQFFNNQ7PEFDAYQCXXKJR76U/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DEQYYGWLJBQQVTAC7E7XSDGVF27NPMPB/
CVE ID: CVE-2019-17110 State: REJECTED Published: 2019-10-03T19:21:51 Last Updated: 2019-11-29T18:07:26 Description: No description available.
CVE ID: CVE-2019-17112 State: PUBLISHED Published: 2019-10-09T19:40:52 Last Updated: 2024-08-05T01:33:17.246Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AC:L/AV:N/A:N/C:L/I:N/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zoho ManageEngine DataSecurity Plus before 5.0.1 5012. An exposed service allows a basic user ("Operator" access level) to access the configuration file of the mail server (except for the password). Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/data-security/release-notes.html - https://excellium-services.com/cert-xlm-advisory/cve-2019-17112/
CVE ID: CVE-2019-17113 State: PUBLISHED Published: 2019-10-03T23:57:36 Last Updated: 2024-08-05T01:33:16.633Z Vendors: n/a Products: n/a Problem Types: n/a Description: In libopenmpt before 0.3.19 and 0.4.x before 0.4.9, ModPlug_InstrumentName and ModPlug_SampleName in libopenmpt_modplug.c do not restrict the lengths of libmodplug output-buffer strings in the C API, leading to a buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OpenMPT/openmpt/commit/927688ddab43c2b203569de79407a899e734fabe - https://source.openmpt.org/browse/openmpt/trunk/OpenMPT/?op=revision&rev=12127&peg=12127 - https://github.com/OpenMPT/openmpt/compare/libopenmpt-0.4.8.
se/openmpt/trunk/OpenMPT/?op=revision&rev=12127&peg=12127 - https://github.com/OpenMPT/openmpt/compare/libopenmpt-0.4.8...libopenmpt-0.4.9 - https://github.com/OpenMPT/openmpt/compare/libopenmpt-0.3.18...libopenmpt-0.3.19 - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00035.html - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00044.html - https://www.debian.org/security/2020/dsa-4729 - https://lists.debian.org/debian-lts-announce/2020/08/msg00003.html
CVE ID: CVE-2019-17114 State: PUBLISHED Published: 2019-10-17T17:44:18 Last Updated: 2024-08-05T01:33:17.058Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored and reflected cross-site scripting (XSS) vulnerability in WiKID 2FA Enterprise Server through 4.2.0-b2047 allows remote attackers to inject arbitrary web script or HTML via /WiKIDAdmin/userPreregistration.jsp. The preRegistrationData parameter is vulnerable: a reflected cross-site scripting occurs immediately after a .csv file is uploaded. The malicious script is stored and can be executed again when the List Pre-Registration functionality is used. Additional Analyst Notes: - CVE Program Container: References: - http
n the List Pre-Registration functionality is used. Additional Analyst Notes: - CVE Program Container: References: - https://www.securitymetrics.com/blog/wikid-2fa-enterprise-server-cross-site-scripting - http://seclists.org/fulldisclosure/2019/Oct/35 - http://packetstormsecurity.com/files/154912/WiKID-Systems-2FA-Enterprise-Server-4.2.0-b2032-SQL-Injection-XSS-CSRF.html