Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-13343 State: PUBLISHED Published: 2019-10-02T15:49:29 Last Updated: 2024-08-04T23:49:24.668Z Severity: CRITICAL (CVSS 9.9 CVSS:3.0/AC:L/AV:N/A:L/C:H/I:L/PR:N/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Butor Portal before 1.0.27 is affected by a Path Traversal vulnerability leading to a pre-authentication arbitrary file download. Effectively, a remote anonymous user can download any file on servers running Butor Portal. WhiteLabelingServlet is responsible for this vulnerability. It does not properly sanitize user input on the theme t parameter before reusing it in a path. This path is then used without validation to fetch a file and return its raw co
t parameter before reusing it in a path. This path is then used without validation to fetch a file and return its raw content to the user via the /wl?t=../../...&h= substring followed by a filename. Additional Analyst Notes: - CVE Program Container: References: - https://bitbucket.org/account/user/butor-team/projects/PROJ - https://bitbucket.org/butor-team/portal/commits/cd7055d33e194fcf530100ee1d8d13aa9cde230b - https://bitbucket.org/butor-team/portal/src/cd7055d33e194fcf530100ee1d8d13aa9cde230b/src/main/java/com/butor/portal/web/servlet/WhiteLabelingServlet.java?at=master - https://www.gosecure.net/blog/2019/09/30/butor-portal-arbitrary-file-download-vulnerability-cve-2019-13343 - https://
- https://www.gosecure.net/blog/2019/09/30/butor-portal-arbitrary-file-download-vulnerability-cve-2019-13343 - https://bitbucket.org/butor-team/portal/commits/all
CVE ID: CVE-2019-13344 State: PUBLISHED Published: 2019-07-05T15:33:45 Last Updated: 2024-08-04T23:49:24.582Z Vendors: n/a Products: n/a Problem Types: n/a Description: An authentication bypass vulnerability in the CRUDLab WP Like Button plugin through 1.6.0 for WordPress allows unauthenticated attackers to change settings. The contains() function in wp_like_button.php did not check if the current request is made by an authorized user, thus allowing any unauthenticated user to successfully update settings, as demonstrated by the wp-admin/admin.php?page=facebook-like-button each_page_url or code_snippet parameter. Additional Analyst Notes: - CVE Program Container: References: - https://limben
each_page_url or code_snippet parameter. Additional Analyst Notes: - CVE Program Container: References: - https://limbenjamin.com/articles/wp-like-button-auth-bypass.html - https://wordpress.org/plugins/wp-like-button/#developers - http://packetstormsecurity.com/files/153541/WordPress-Like-Button-1.6.0-Authentication-Bypass.html - https://wpvulndb.com/vulnerabilities/9432
CVE ID: CVE-2019-13345 State: PUBLISHED Published: 2019-07-05T15:45:45 Last Updated: 2024-08-04T23:49:24.644Z Vendors: n/a Products: n/a Problem Types: n/a Description: The cachemgr.cgi web module of Squid through 4.7 has XSS via the user_name or auth parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/squid-cache/squid/pull/429 - https://bugs.squid-cache.org/show_bug.cgi?id=4957 - https://lists.debian.org/debian-lts-announce/2019/07/msg00006.html - https://usn.ubuntu.com/4059-1/ - https://usn.ubuntu.com/4059-2/ - http://www.securityfocus.com/bid/109095 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/messag
tyfocus.com/bid/109095 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X2ERPHSPUGOYVVRPQRASQBFGS2EJISFC/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPXN2CLAGN5QSQBTOV5IGVLDOQSRFNTZ/ - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00067.html - https://www.debian.org/security/2019/dsa-4507 - https://seclists.org/bugtraq/2019/Aug/42 - https://access.redhat.com/errata/RHSA-2019:3476 - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00053.html - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00056.html - https://lists.debian.org/debian-lts-a
tml - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00056.html - https://lists.debian.org/debian-lts-announce/2020/07/msg00009.html
CVE ID: CVE-2019-13346 State: PUBLISHED Published: 2019-07-17T16:21:18 Last Updated: 2024-08-04T23:49:24.610Z Vendors: n/a Products: n/a Problem Types: n/a Description: In MyT 1.5.1, the User[username] parameter has XSS. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/47109
CVE ID: CVE-2019-13347 State: PUBLISHED Published: 2019-12-13T12:17:14 Last Updated: 2024-08-04T23:49:24.589Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the SAML Single Sign On (SSO) plugin for several Atlassian products affecting versions 3.1.0 through 3.2.2 for Jira and Confluence, versions 2.4.0 through 3.0.3 for Bitbucket, and versions 2.4.0 through 2.5.2 for Bamboo. It allows locally disabled users to reactivate their accounts just by browsing the affected Jira/Confluence/Bitbucket/Bamboo instance, even when the applicable configuration option of the plugin has been disabled ("Reactivate inactive users"). Exploiting this vulnerability requires
figuration option of the plugin has been disabled ("Reactivate inactive users"). Exploiting this vulnerability requires an attacker to be authorized by the identity provider and requires that the plugin's configuration option "User Update Method" have the "Update from SAML Attributes" value. Additional Analyst Notes: - CVE Program Container: References: - https://marketplace.atlassian.com/apps/1212129/saml-single-sign-on-sso-confluence?hosting=server&tab=overview - https://wiki.resolution.de/doc/saml-sso/latest/all/security-advisories/2019-07-11-users-are-always-re-enabled-during-login-when-updated
CVE ID: CVE-2019-13348 State: PUBLISHED Published: 2019-08-28T15:46:19 Last Updated: 2024-08-04T23:49:24.696Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Knowage through 6.1.1, an authenticated user who accesses the datasources page will gain access to any data source credentials in cleartext, which includes databases. Additional Analyst Notes: - CVE Program Container: References: - https://blog.contentsecurity.com.au/knowage-password-disclosure
CVE ID: CVE-2019-13349 State: PUBLISHED Published: 2019-09-05T17:19:16 Last Updated: 2024-08-04T23:49:24.655Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Knowage through 6.1.1, an authenticated user that accesses the users page will obtain all user password hashes. Additional Analyst Notes: - CVE Program Container: References: - https://blog.contentsecurity.com.au/knowage-password-hash-disclosure
CVE ID: CVE-2019-13351 State: PUBLISHED Published: 2019-07-05T19:20:39 Last Updated: 2024-08-04T23:49:24.816Z Vendors: n/a Products: n/a Problem Types: n/a Description: posix/JackSocket.cpp in libjack in JACK2 1.9.1 through 1.9.12 (as distributed with alsa-plugins 1.1.7 and later) has a "double file descriptor close" issue during a failed connection attempt when jackd2 is not running. Exploitation success depends on multithreaded timing of that double close, which can result in unintended information disclosure, crashes, or file corruption due to having the wrong file associated with the file descriptor. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jack
iated with the file descriptor. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jackaudio/jack2/pull/480 - https://github.com/xbmc/xbmc/issues/16258
CVE ID: CVE-2019-13352 State: PUBLISHED Published: 2019-07-05T19:33:50 Last Updated: 2024-08-04T23:49:24.830Z Vendors: n/a Products: n/a Problem Types: n/a Description: WolfVision Cynap before 1.30j uses a static, hard-coded cryptographic secret for generating support PINs for the 'forgot password' feature. By knowing this static secret and the corresponding algorithm for calculating support PINs, an attacker can reset the ADMIN password and thus gain remote access. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/153530/WolfVision-Cynap-1.18g-1.28j-Hardcoded-Credential.html - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisorie
WolfVision-Cynap-1.18g-1.28j-Hardcoded-Credential.html - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2019-021.txt - http://seclists.org/fulldisclosure/2019/Jul/9
CVE ID: CVE-2019-13354 State: PUBLISHED Published: 2019-07-08T13:26:10 Last Updated: 2024-08-04T23:49:24.697Z Vendors: n/a Products: n/a Problem Types: n/a Description: The strong_password gem 0.0.7 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. The current version, without this backdoor, is 0.0.6. Additional Analyst Notes: - CVE Program Container: References: - https://rubygems.org/gems/strong_password/versions - https://github.com/bdmac/strong_password/releases - https://withatwist.dev/strong-password-rubygem-hijacked.html - https://benjamin-bouchet.com/blog/vulnerabilite-dans-la-gem-strong_password-0-0-7/
CVE ID: CVE-2019-13355 State: PUBLISHED Published: 2019-09-24T14:09:43 Last Updated: 2024-08-04T23:49:24.681Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Total Defense Anti-virus 9.0.0.773, insecure access control for the directory %PROGRAMDATA%\TotalDefense\Consumer\ISS\9\ used by ccschedulersvc.exe allows local attackers to hijack dotnetproxy.exe, which leads to privilege escalation when the ccSchedulerSVC service runs the executable. Additional Analyst Notes: - CVE Program Container: References: - https://www.totaldefense.com/security-blog - https://github.com/NtRaiseHardError/Antimalware-Research/tree/master/Total%20Defense/Local%20Privilege%20Escalation/v9.0.0.773
CVE ID: CVE-2019-13356 State: PUBLISHED Published: 2019-09-24T14:09:04 Last Updated: 2024-08-04T23:49:24.986Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Total Defense Anti-virus 9.0.0.773, insecure access control for the directory %PROGRAMDATA%\TotalDefense\Consumer\ISS\9\bd\TDUpdate2\ used by AMRT.exe allows local attackers to hijack bdcore.dll, which leads to privilege escalation when the AMRT service loads the DLL. Additional Analyst Notes: - CVE Program Container: References: - https://www.totaldefense.com/security-blog - https://github.com/NtRaiseHardError/Antimalware-Research/tree/master/Total%20Defense/Local%20Privilege%20Escalation/v9.0.0.773
CVE ID: CVE-2019-13357 State: PUBLISHED Published: 2019-09-24T14:08:14 Last Updated: 2024-08-04T23:49:25.022Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Total Defense Anti-virus 9.0.0.773, resource acquisition from the untrusted search path C:\ used by caschelp.exe allows local attackers to hijack ccGUIFrm.dll, which leads to code execution. SYSTEM-level code execution can be achieved when the ccSchedulerSVC service runs the affected executable. Additional Analyst Notes: - CVE Program Container: References: - https://www.totaldefense.com/security-blog - https://github.com/NtRaiseHardError/Antimalware-Research/tree/master/Total%20Defense/DLL%20Hijacking/v9.0.0.773
CVE ID: CVE-2019-13358 State: PUBLISHED Published: 2019-07-05T20:26:22 Last Updated: 2024-08-04T23:49:24.692Z Vendors: n/a Products: n/a Problem Types: n/a Description: lib/DocumentToText.php in OpenCats before 0.9.4-3 has XXE that allows remote users to read files on the underlying operating system. The attacker must upload a file in the docx or odt format. Additional Analyst Notes: - CVE Program Container: References: - http://www.opencats.org/news/ - https://github.com/opencats/OpenCATS/pull/440 - https://doddsecurity.com/312/xml-external-entity-injection-xxe-in-opencats-applicant-tracking-system/ - http://packetstormsecurity.com/files/164253/OpenCats-0.9.4-2-XML-Injection.html
CVE ID: CVE-2019-13359 State: PUBLISHED Published: 2019-07-16T17:02:22 Last Updated: 2024-08-04T23:49:24.753Z Vendors: n/a Products: n/a Problem Types: n/a Description: In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.836, a cwpsrv-xxx cookie allows a normal user to craft and upload a session file to the /tmp directory, and use it to become the root user. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/i3umi3iei3ii/CentOS-Control-Web-Panel-CVE/blob/master/CVE-2019-13359.md - http://packetstormsecurity.com/files/153666/CentOS-Control-Web-Panel-0.9.8.836-Privilege-Escalation.html
CVE ID: CVE-2019-13360 State: PUBLISHED Published: 2019-07-16T17:00:14 Last Updated: 2024-08-04T23:49:25.024Z Vendors: n/a Products: n/a Problem Types: n/a Description: In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.836, remote attackers can bypass authentication in the login process by leveraging knowledge of a valid username. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/i3umi3iei3ii/CentOS-Control-Web-Panel-CVE/blob/master/CVE-2019-13360.md - http://packetstormsecurity.com/files/153665/CentOS-Control-Web-Panel-0.9.8.836-Authentication-Bypass.html
CVE ID: CVE-2019-13361 State: PUBLISHED Published: 2019-09-05T16:31:31 Last Updated: 2024-08-04T23:49:24.947Z Vendors: n/a Products: n/a Problem Types: n/a Description: Smanos W100 1.0.0 devices have Insecure Permissions, exploitable by an attacker on the same Wi-Fi network. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/lodi-g/CVE-2019-13361/
CVE ID: CVE-2019-13362 State: PUBLISHED Published: 2019-07-06T20:19:35 Last Updated: 2024-08-04T23:49:24.985Z Vendors: n/a Products: n/a Problem Types: n/a Description: Codedoc v3.2 has a stack-based buffer overflow in add_variable in codedoc.c, related to codedoc_strlcpy. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/michaelrsweet/codedoc/issues/5
CVE ID: CVE-2019-13363 State: PUBLISHED Published: 2019-09-13T12:22:58 Last Updated: 2024-08-04T23:49:24.971Z Vendors: n/a Products: n/a Problem Types: n/a Description: admin.php?page=notification_by_mail in Piwigo 2.9.5 has XSS via the nbm&#95;send&#95;html&#95;mail, nbm&#95;send&#95;mail&#95;as, nbm&#95;send&#95;detailed&#95;content, nbm&#95;complementary&#95;mail&#95;content, nbm&#95;send&#95;recent&#95;post&#95;dates, or param&#95;submit parameter. This is exploitable via CSRF. Additional Analyst Notes: - CVE Program Container: References: - https://piwigo.com - https://github.com/Piwigo/Piwigo/issues - http://seclists.org/fulldisclosure/2019/Sep/25 - http://packetstormsecurity.com/files
/github.com/Piwigo/Piwigo/issues - http://seclists.org/fulldisclosure/2019/Sep/25 - http://packetstormsecurity.com/files/154484/Piwigo-2.9.5-Cross-Site-Request-Forgery-Cross-Site-Scripting.html - http://seclists.org/fulldisclosure/2020/Jun/29
CVE ID: CVE-2019-13364 State: PUBLISHED Published: 2019-09-13T12:24:45 Last Updated: 2024-08-04T23:49:24.765Z Vendors: n/a Products: n/a Problem Types: n/a Description: admin.php?page=account_billing in Piwigo 2.9.5 has XSS via the vat&#95;number, billing&#95;name, company, or billing&#95;address parameter. This is exploitable via CSRF. Additional Analyst Notes: - CVE Program Container: References: - https://piwigo.com - https://github.com/Piwigo/Piwigo/issues - http://seclists.org/fulldisclosure/2019/Sep/25 - http://packetstormsecurity.com/files/154484/Piwigo-2.9.5-Cross-Site-Request-Forgery-Cross-Site-Scripting.html - http://seclists.org/fulldisclosure/2020/Jun/29
CVE ID: CVE-2019-13367 State: REJECTED Published: 2019-07-08T21:03:26 Last Updated: 2019-07-08T21:03:26 Description: No description available.
CVE ID: CVE-2019-13368 State: REJECTED Published: 2019-07-08T21:04:18 Last Updated: 2019-07-08T21:04:18 Description: No description available.
CVE ID: CVE-2019-13369 State: REJECTED Published: 2019-07-08T21:05:23 Last Updated: 2019-07-08T21:05:23 Description: No description available.
CVE ID: CVE-2019-13370 State: PUBLISHED Published: 2019-07-06T21:48:00 Last Updated: 2024-08-04T23:49:24.599Z Vendors: n/a Products: n/a Problem Types: n/a Description: index.php/admin/permissions in Ignited CMS through 2017-02-19 allows CSRF to add an administrator. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ignitedcms/ignitedcms/issues/7
CVE ID: CVE-2019-13372 State: PUBLISHED Published: 2019-07-06T22:54:37 Last Updated: 2024-08-04T23:49:24.808Z Vendors: n/a Products: n/a Problem Types: n/a Description: /web/Lib/Action/IndexAction.class.php in D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6 allows remote attackers to execute arbitrary PHP code via a cookie because a cookie's username field allows eval injection, and an empty password bypasses authentication. Additional Analyst Notes: - CVE Program Container: References: - https://unh3x.github.io/2019/02/21/D-link-%28CWM-100%29-Multiple-Vulnerabilities/ - https://github.com/unh3x/unh3x.github.io/blob/master/_posts/2019-02-21-D-link-%28CWM-100%29-Multiple-Vulnerab
ilities/ - https://github.com/unh3x/unh3x.github.io/blob/master/_posts/2019-02-21-D-link-%28CWM-100%29-Multiple-Vulnerabilities.md - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10117 - http://packetstormsecurity.com/files/158904/D-Link-Central-WiFi-Manager-CWM-100-Remote-Code-Execution.html
CVE ID: CVE-2019-13373 State: PUBLISHED Published: 2019-07-06T22:54:48 Last Updated: 2024-08-04T23:49:24.946Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6. Input does not get validated and arbitrary SQL statements can be executed in the database via the /web/Public/Conn.php parameter dbSQL. Additional Analyst Notes: - CVE Program Container: References: - https://unh3x.github.io/2019/02/21/D-link-%28CWM-100%29-Multiple-Vulnerabilities/ - https://github.com/unh3x/unh3x.github.io/blob/master/_posts/2019-02-21-D-link-%28CWM-100%29-Multiple-Vulnerabilities.md - https://supportannouncement.us.
thub.io/blob/master/_posts/2019-02-21-D-link-%28CWM-100%29-Multiple-Vulnerabilities.md - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10117
CVE ID: CVE-2019-13374 State: PUBLISHED Published: 2019-07-06T22:54:58 Last Updated: 2024-08-04T23:49:24.746Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in resource view in PayAction.class.php in D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6 allows remote attackers to inject arbitrary web script or HTML via the index.php/Pay/passcodeAuth passcode parameter. Additional Analyst Notes: - CVE Program Container: References: - https://unh3x.github.io/2019/02/21/D-link-%28CWM-100%29-Multiple-Vulnerabilities/ - https://github.com/unh3x/unh3x.github.io/blob/master/_posts/2019-02-21-D-link-%28CWM-100%29-Multiple-Vulnerabilities.
- https://github.com/unh3x/unh3x.github.io/blob/master/_posts/2019-02-21-D-link-%28CWM-100%29-Multiple-Vulnerabilities.md - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10117
CVE ID: CVE-2019-13375 State: PUBLISHED Published: 2019-07-06T22:55:13 Last Updated: 2024-08-04T23:49:24.629Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection was discovered in D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6 in PayAction.class.php with the index.php/Pay/passcodeAuth parameter passcode. The vulnerability does not need any authentication. Additional Analyst Notes: - CVE Program Container: References: - https://unh3x.github.io/2019/02/21/D-link-%28CWM-100%29-Multiple-Vulnerabilities/ - https://github.com/unh3x/unh3x.github.io/blob/master/_posts/2019-02-21-D-link-%28CWM-100%29-Multiple-Vulnerabilities.md - https://supportannouncement.us.dli
b.io/blob/master/_posts/2019-02-21-D-link-%28CWM-100%29-Multiple-Vulnerabilities.md - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10117
CVE ID: CVE-2019-13376 State: PUBLISHED Published: 2019-09-27T12:08:57 Last Updated: 2024-08-04T23:49:24.815Z Vendors: n/a Products: n/a Problem Types: n/a Description: phpBB version 3.2.7 allows the stealing of an Administration Control Panel session id by leveraging CSRF in the Remote Avatar feature. The CSRF Token Hijacking leads to stored XSS Additional Analyst Notes: - CVE Program Container: References: - https://blog.phpbb.com/category/security/ - https://ssd-disclosure.com/archives/4007/ssd-advisory-phpbb-csrf-token-hijacking-leading-to-stored-xss
CVE ID: CVE-2019-13377 State: PUBLISHED Published: 2019-08-15T16:05:29 Last Updated: 2024-08-04T23:49:24.914Z Vendors: n/a Products: n/a Problem Types: n/a Description: The implementations of SAE and EAP-pwd in hostapd and wpa_supplicant 2.x through 2.8 are vulnerable to side-channel attacks as a result of observable timing differences and cache access patterns when Brainpool curves are used. An attacker may be able to gain leaked information from a side-channel attack that can be used for full password recovery. Additional Analyst Notes: - CVE Program Container: References: - https://w1.fi/cgit/hostap/commit/?id=147bf7b88a9c231322b5b574263071ca6dbb0503 - https://w1.fi/cgit/hostap/commit/?id
: - https://w1.fi/cgit/hostap/commit/?id=147bf7b88a9c231322b5b574263071ca6dbb0503 - https://w1.fi/cgit/hostap/commit/?id=cd803299ca485eb857e37c88f973fccfbb8600e5 - https://usn.ubuntu.com/4098-1/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IELLEPIXWQOJFW4SZMU3WQHO63JFAHA4/ - https://www.debian.org/security/2019/dsa-4538 - https://seclists.org/bugtraq/2019/Sep/56
CVE ID: CVE-2019-13379 State: PUBLISHED Published: 2019-07-07T15:44:11 Last Updated: 2024-08-04T23:49:24.971Z Vendors: n/a Products: n/a Problem Types: n/a Description: On AVTECH Room Alert 3E devices before 2.2.5, an attacker with access to the device's web interface may escalate privileges from an unauthenticated user to administrator by performing a cmd.cgi?action=ResetDefaults&src=RA reset and using the default credentials to get in. Additional Analyst Notes: - CVE Program Container: References: - https://jordonlovik.wordpress.com/2019/07/06/roomalert-by-avtech-critical-vulnerability-disclosure/ - https://www.youtube.com/watch?v=X1PY7kMFkVg - https://psirt.global.sonicwall.com/vuln-detai
-vulnerability-disclosure/ - https://www.youtube.com/watch?v=X1PY7kMFkVg - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010
CVE ID: CVE-2019-13380 State: PUBLISHED Published: 2019-07-09T20:36:05 Last Updated: 2024-08-04T23:49:25.022Z Vendors: n/a Products: n/a Problem Types: n/a Description: KEYNTO Team Password Manager 1.5.0 allows XSS because data saved from websites is mishandled in the online vault. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2019/Jul/5 - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010
CVE ID: CVE-2019-13381 State: REJECTED Published: 2019-07-10T20:52:29 Last Updated: 2019-07-10T20:52:29 Description: No description available.
CVE ID: CVE-2019-13382 State: PUBLISHED Published: 2019-07-26T12:25:19 Last Updated: 2024-08-04T23:49:24.694Z Vendors: n/a Products: n/a Problem Types: n/a Description: UploaderService in SnagIT 2019.1.2 allows elevation of privilege by placing an invalid presentation file in %PROGRAMDATA%\TechSmith\TechSmith Recorder\QueuedPresentations and then creating a symbolic link in %PROGRAMDATA%\Techsmith\TechSmith Recorder\InvalidPresentations that points to an arbitrary folder with an arbitrary file name. TechSmith Relay Classic Recorder prior to 5.2.1 on Windows is vulnerable. The vulnerability was introduced in SnagIT Windows 12.4.1. Additional Analyst Notes: - CVE Program Container: References:
he vulnerability was introduced in SnagIT Windows 12.4.1. Additional Analyst Notes: - CVE Program Container: References: - https://posts.specterops.io/cve-2019-13382-local-privilege-escalation-in-snagit-abe5f31c349 - https://support.techsmith.com/hc/en-us/articles/115006435067-Snagit-Windows-Version-History - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010