Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-10888 State: PUBLISHED Published: 2019-04-05T17:35:01 Last Updated: 2024-08-04T22:40:15.143Z Vendors: n/a Products: n/a Problem Types: n/a Description: A CSRF Issue that can add an admin user was discovered in UKcms v1.1.10 via admin.php/admin/role/add.html. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/yxcmf/ukcms/issues/4
CVE ID: CVE-2019-10891 State: PUBLISHED Published: 2019-09-06T19:34:44 Last Updated: 2025-01-09T17:39:00.233Z Vendors: n/a Products: n/a Problem Types: CWE-78 Description: An issue was discovered in D-Link DIR-806 devices. There is a command injection in function hnap_main, which calls system() without checking the parameter that can be controlled by user, and finally allows remote attackers to execute arbitrary shell commands with a special HTTP header. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Kirin-say/Vulnerabilities/blob/master/DIR-806_Code_Injection.md - https://supportannouncement.us.dlink.com/announcement/publication.
lnerabilities/blob/master/DIR-806_Code_Injection.md - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10282
CVE ID: CVE-2019-10892 State: PUBLISHED Published: 2019-09-06T19:58:12 Last Updated: 2024-08-04T22:40:15.119Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in D-Link DIR-806 devices. There is a stack-based buffer overflow in function hnap_main at /htdocs/cgibin. The function will call sprintf without checking the length of strings in parameters given by HTTP header and can be controlled by users. And it finally leads to a stack-based buffer overflow via a special HTTP header. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Kirin-say/Vulnerabilities/blob/master/DIR-806_Stack_Overflow_to_Run_Shellcode.md
CVE ID: CVE-2019-10893 State: PUBLISHED Published: 2019-04-18T19:50:16 Last Updated: 2024-08-04T22:40:15.137Z Vendors: n/a Products: n/a Problem Types: n/a Description: CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.793 (Free/Open Source Version) and 0.9.8.753 (Pro) is vulnerable to Stored/Persistent XSS for Admin Email fields on the "CWP Settings > "Edit Settings" screen. By changing the email ID to any XSS Payload and clicking on Save Changes, the XSS Payload will execute. Additional Analyst Notes: - CVE Program Container: References: - http://forum.centos-webpanel.com/informations/ - https://www.exploit-db.com/exploits/46669/ - http://packetstormsecurity.com/files/152437/CentOS-Web-
com/informations/ - https://www.exploit-db.com/exploits/46669/ - http://packetstormsecurity.com/files/152437/CentOS-Web-Panel-0.9.8.793-Free-0.9.8.753-Pro-Cross-Site-Scripting.html - https://packetstormsecurity.com/files/152437/centoswp098email-xss.txt - http://www.securityfocus.com/bid/108035 - https://www.exploit-db.com/exploits/46669
CVE ID: CVE-2019-10894 State: PUBLISHED Published: 2019-04-09T03:50:22 Last Updated: 2024-08-04T22:40:15.040Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the GSS-API dissector could crash. This was addressed in epan/dissectors/packet-gssapi.c by ensuring that a valid dissector is called. Additional Analyst Notes: - CVE Program Container: References: - https://www.wireshark.org/security/wnpa-sec-2019-14.html - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15613 - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=b20e5d8aae2580e29c83ddaf0b6b2e640603e4aa - http://www.securityfocus.com/bid/107834
itweb?p=wireshark.git%3Ba=commit%3Bh=b20e5d8aae2580e29c83ddaf0b6b2e640603e4aa - http://www.securityfocus.com/bid/107834 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PU3QA2DUO3XS24QE24CQRP4A4XQQY76R/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4LYIOOQIMFQ3PA7AFBK4DNXHISTEYUC5/ - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00022.html - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00027.html - https://usn.ubuntu.com/3986-1/ - https://lists.debian.org/debian-lts-announce/2019/05/msg00034.html - http://lists.opensuse.org/opensuse-security-announce/202
://lists.debian.org/debian-lts-announce/2019/05/msg00034.html - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html - https://lists.debian.org/debian-lts-announce/2020/10/msg00036.html
CVE ID: CVE-2019-10895 State: PUBLISHED Published: 2019-04-09T03:50:45 Last Updated: 2024-08-04T22:40:15.290Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the NetScaler file parser could crash. This was addressed in wiretap/netscaler.c by improving data validation. Additional Analyst Notes: - CVE Program Container: References: - https://www.wireshark.org/security/wnpa-sec-2019-09.html - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15497 - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=cab0cff6abdd7a5b5b0bfa4ee204eea951e129e9 - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=com
a=commit%3Bh=cab0cff6abdd7a5b5b0bfa4ee204eea951e129e9 - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=38680c4c69f9f4e0f39e29b66fe2b02d88eb629d - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=2fbbde780e5d5d82e31dca656217daf278cf62bb - http://www.securityfocus.com/bid/107834 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PU3QA2DUO3XS24QE24CQRP4A4XQQY76R/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4LYIOOQIMFQ3PA7AFBK4DNXHISTEYUC5/ - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00022.html - http://lists.opensuse.org/ope
XHISTEYUC5/ - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00022.html - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00027.html - https://usn.ubuntu.com/3986-1/ - https://lists.debian.org/debian-lts-announce/2019/05/msg00034.html - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html - https://lists.debian.org/debian-lts-announce/2020/10/msg00036.html
CVE ID: CVE-2019-10896 State: PUBLISHED Published: 2019-04-09T03:50:58 Last Updated: 2024-08-04T22:40:15.129Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the DOF dissector could crash. This was addressed in epan/dissectors/packet-dof.c by properly handling generated IID and OID bytes. Additional Analyst Notes: - CVE Program Container: References: - https://www.wireshark.org/security/wnpa-sec-2019-15.html - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15617 - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=441b6d9071d6341e58dfe10719375489c5b8e3f0 - http://www.securityfocus.com/bid/107834 - h
eb?p=wireshark.git%3Ba=commit%3Bh=441b6d9071d6341e58dfe10719375489c5b8e3f0 - http://www.securityfocus.com/bid/107834 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PU3QA2DUO3XS24QE24CQRP4A4XQQY76R/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4LYIOOQIMFQ3PA7AFBK4DNXHISTEYUC5/ - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00022.html - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00027.html - https://usn.ubuntu.com/3986-1/ - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html - https://lists.debian.org/debian-lts-announce/2020/1
ists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html - https://lists.debian.org/debian-lts-announce/2020/10/msg00036.html
CVE ID: CVE-2019-10897 State: PUBLISHED Published: 2019-04-09T03:52:14 Last Updated: 2024-08-04T22:40:15.163Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Wireshark 3.0.0, the IEEE 802.11 dissector could go into an infinite loop. This was addressed in epan/dissectors/packet-ieee80211.c by detecting cases in which the bit offset does not advance. Additional Analyst Notes: - CVE Program Container: References: - https://www.wireshark.org/security/wnpa-sec-2019-11.html - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15553 - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=00d5e9e9fb377f52ab7696f25c1dbc011ef0244d - http://www.securityfocus.com/bid/107
ew/gitweb?p=wireshark.git%3Ba=commit%3Bh=00d5e9e9fb377f52ab7696f25c1dbc011ef0244d - http://www.securityfocus.com/bid/107836 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PU3QA2DUO3XS24QE24CQRP4A4XQQY76R/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4LYIOOQIMFQ3PA7AFBK4DNXHISTEYUC5/ - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html
CVE ID: CVE-2019-10898 State: PUBLISHED Published: 2019-04-09T03:52:25 Last Updated: 2024-08-04T22:40:15.040Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Wireshark 3.0.0, the GSUP dissector could go into an infinite loop. This was addressed in epan/dissectors/packet-gsm_gsup.c by rejecting an invalid Information Element length. Additional Analyst Notes: - CVE Program Container: References: - https://www.wireshark.org/security/wnpa-sec-2019-12.html - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15585 - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=f80b7d1b279fb6c13f640019a1bbc42b18bf7469 - http://www.securityfocus.com/bid/107836 - https://lis
hark.git%3Ba=commit%3Bh=f80b7d1b279fb6c13f640019a1bbc42b18bf7469 - http://www.securityfocus.com/bid/107836 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PU3QA2DUO3XS24QE24CQRP4A4XQQY76R/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4LYIOOQIMFQ3PA7AFBK4DNXHISTEYUC5/ - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html
CVE ID: CVE-2019-10899 State: PUBLISHED Published: 2019-04-09T03:52:41 Last Updated: 2024-08-04T22:40:15.111Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the SRVLOC dissector could crash. This was addressed in epan/dissectors/packet-srvloc.c by preventing a heap-based buffer under-read. Additional Analyst Notes: - CVE Program Container: References: - https://www.wireshark.org/security/wnpa-sec-2019-10.html - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15546 - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=b16fea2f175a3297edac118c8844c7987d31c1cb - http://www.securityfocus.com/bid/107834 -
tweb?p=wireshark.git%3Ba=commit%3Bh=b16fea2f175a3297edac118c8844c7987d31c1cb - http://www.securityfocus.com/bid/107834 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PU3QA2DUO3XS24QE24CQRP4A4XQQY76R/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4LYIOOQIMFQ3PA7AFBK4DNXHISTEYUC5/ - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00022.html - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00027.html - https://usn.ubuntu.com/3986-1/ - https://lists.debian.org/debian-lts-announce/2019/05/msg00034.html - http://lists.opensuse.org/opensuse-security-announce/2020
//lists.debian.org/debian-lts-announce/2019/05/msg00034.html - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html - https://lists.debian.org/debian-lts-announce/2020/10/msg00036.html
CVE ID: CVE-2019-10900 State: PUBLISHED Published: 2019-04-09T03:52:55 Last Updated: 2024-08-04T22:40:15.119Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Wireshark 3.0.0, the Rbm dissector could go into an infinite loop. This was addressed in epan/dissectors/file-rbm.c by handling unknown object types safely. Additional Analyst Notes: - CVE Program Container: References: - https://www.wireshark.org/security/wnpa-sec-2019-13.html - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15612 - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=26eee01f57f0a86fb375892c7937eac24ede4610 - http://www.securityfocus.com/bid/107836 - https://lists.fedoraproject.or
%3Bh=26eee01f57f0a86fb375892c7937eac24ede4610 - http://www.securityfocus.com/bid/107836 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PU3QA2DUO3XS24QE24CQRP4A4XQQY76R/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4LYIOOQIMFQ3PA7AFBK4DNXHISTEYUC5/ - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html
CVE ID: CVE-2019-10901 State: PUBLISHED Published: 2019-04-09T03:53:11 Last Updated: 2024-08-04T22:40:15.280Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the LDSS dissector could crash. This was addressed in epan/dissectors/packet-ldss.c by handling file digests properly. Additional Analyst Notes: - CVE Program Container: References: - https://www.wireshark.org/security/wnpa-sec-2019-17.html - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15620 - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=cf801a25074f76dc3ae62d8ec53ace75f56ce2cd - http://www.securityfocus.com/bid/107834 - https://lists.
k.git%3Ba=commit%3Bh=cf801a25074f76dc3ae62d8ec53ace75f56ce2cd - http://www.securityfocus.com/bid/107834 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PU3QA2DUO3XS24QE24CQRP4A4XQQY76R/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4LYIOOQIMFQ3PA7AFBK4DNXHISTEYUC5/ - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00022.html - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00027.html - https://usn.ubuntu.com/3986-1/ - https://lists.debian.org/debian-lts-announce/2019/05/msg00034.html - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.ht
org/debian-lts-announce/2019/05/msg00034.html - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html - https://lists.debian.org/debian-lts-announce/2020/10/msg00036.html
CVE ID: CVE-2019-10902 State: PUBLISHED Published: 2019-04-09T03:53:25 Last Updated: 2024-08-04T22:40:15.193Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Wireshark 3.0.0, the TSDNS dissector could crash. This was addressed in epan/dissectors/packet-tsdns.c by splitting strings safely. Additional Analyst Notes: - CVE Program Container: References: - https://www.wireshark.org/security/wnpa-sec-2019-16.html - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15619 - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=95571f17d5e2de39735e62e5251583f930c06d51 - http://www.securityfocus.com/bid/107836 - https://lists.fedoraproject.org/archives/list/package-a
62e5251583f930c06d51 - http://www.securityfocus.com/bid/107836 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PU3QA2DUO3XS24QE24CQRP4A4XQQY76R/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4LYIOOQIMFQ3PA7AFBK4DNXHISTEYUC5/ - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html
CVE ID: CVE-2019-10903 State: PUBLISHED Published: 2019-04-09T03:53:43 Last Updated: 2024-08-04T22:40:15.428Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the DCERPC SPOOLSS dissector could crash. This was addressed in epan/dissectors/packet-dcerpc-spoolss.c by adding a boundary check. Additional Analyst Notes: - CVE Program Container: References: - https://www.wireshark.org/security/wnpa-sec-2019-18.html - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15568 - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=eafdcfa4b6d5187a5326442a82608ab03d9dddcb - http://www.securityfocus.com/bid/107834 - h
eb?p=wireshark.git%3Ba=commit%3Bh=eafdcfa4b6d5187a5326442a82608ab03d9dddcb - http://www.securityfocus.com/bid/107834 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PU3QA2DUO3XS24QE24CQRP4A4XQQY76R/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4LYIOOQIMFQ3PA7AFBK4DNXHISTEYUC5/ - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00022.html - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00027.html - https://usn.ubuntu.com/3986-1/ - https://lists.debian.org/debian-lts-announce/2019/05/msg00034.html - http://lists.opensuse.org/opensuse-security-announce/2020-0
lists.debian.org/debian-lts-announce/2019/05/msg00034.html - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00027.html - https://lists.debian.org/debian-lts-announce/2020/10/msg00036.html
CVE ID: CVE-2019-10904 State: PUBLISHED Published: 2019-04-06T19:40:05 Last Updated: 2024-08-04T22:40:15.343Z Vendors: n/a Products: n/a Problem Types: n/a Description: Roundup 1.6 allows XSS via the URI because frontends/roundup.cgi and roundup/cgi/wsgi_handler.py mishandle 404 errors. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/python/bugs.python.org/issues/34 - https://bugs.python.org/issue36391 - https://www.openwall.com/lists/oss-security/2019/04/05/1 - http://www.openwall.com/lists/oss-security/2019/04/07/1 - https://lists.debian.org/debian-lts-announce/2019/04/msg00009.html
CVE ID: CVE-2019-10905 State: PUBLISHED Published: 2019-04-06T19:59:55 Last Updated: 2024-08-04T22:40:14.992Z Vendors: n/a Products: n/a Problem Types: n/a Description: Parsedown before 1.7.2, when safe mode is used and HTML markup is disabled, might allow attackers to execute arbitrary JavaScript code if a script (already running on the affected page) executes the contents of any element with a specific class. This occurs because spaces are permitted in code block infostrings, which interferes with the intended behavior of a single class name beginning with the language- substring. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/erusev/parsedown/issues/69
ubstring. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/erusev/parsedown/issues/699 - https://github.com/erusev/parsedown/releases/tag/1.7.2
CVE ID: CVE-2019-10906 State: PUBLISHED Published: 2019-04-06T23:17:03 Last Updated: 2024-08-04T22:40:15.214Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape. Additional Analyst Notes: - CVE Program Container: References: - https://palletsprojects.com/blog/jinja-2-10-1-released - https://lists.apache.org/thread.html/46c055e173b52d599c648a98199972dbd6a89d2b4c4647b0500f2284%40%3Cdevnull.infra.apache.org%3E - https://lists.apache.org/thread.html/b2380d147b508bbcb90d2cad443c159e63e12555966ab4f320ee22da%40%3Ccommits.airflow.apache.org%3E - https://lists.apache.org/thread.html/f0c4a03418bcfe70c539c5dbaf99c04c98da13bf
e22da%40%3Ccommits.airflow.apache.org%3E - https://lists.apache.org/thread.html/f0c4a03418bcfe70c539c5dbaf99c04c98da13bfa1d3266f08564316%40%3Ccommits.airflow.apache.org%3E - https://lists.apache.org/thread.html/57673a78c4d5c870d3f21465c7e2946b9f8285c7c57e54c2ae552f02%40%3Ccommits.airflow.apache.org%3E - https://lists.apache.org/thread.html/320441dccbd9a545320f5f07306d711d4bbd31ba43dc9eebcfc602df%40%3Cdevnull.infra.apache.org%3E - https://lists.apache.org/thread.html/2b52b9c8b9d6366a4f1b407a8bde6af28d9fc73fdb3b37695fd0d9ac%40%3Cdevnull.infra.apache.org%3E - https://lists.apache.org/thread.html/7f39f01392d320dfb48e4901db68daeece62fd60ef20955966739993%40%3Ccommits.airflow.apache.org%3E - https:
che.org/thread.html/7f39f01392d320dfb48e4901db68daeece62fd60ef20955966739993%40%3Ccommits.airflow.apache.org%3E - https://lists.apache.org/thread.html/09fc842ff444cd43d9d4c510756fec625ef8eb1175f14fd21de2605f%40%3Cdevnull.infra.apache.org%3E - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QCDYIS254EJMBNWOG4S5QY6AOTOR4TZU/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DSW3QZMFVVR7YE3UT4YRQA272TYAL5AF/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TS7IVZAJBWOHNRDMFJDIZVFCMRP6YIUQ/ - https://access.redhat.com/errata/RHSA-2019:1152 - http://l
fedoraproject.org/message/TS7IVZAJBWOHNRDMFJDIZVFCMRP6YIUQ/ - https://access.redhat.com/errata/RHSA-2019:1152 - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00030.html - https://access.redhat.com/errata/RHSA-2019:1237 - https://access.redhat.com/errata/RHSA-2019:1329 - https://usn.ubuntu.com/4011-1/ - https://usn.ubuntu.com/4011-2/ - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00064.html
CVE ID: CVE-2019-10907 State: PUBLISHED Published: 2019-04-07T13:32:37 Last Updated: 2024-08-04T22:40:15.275Z Vendors: n/a Products: n/a Problem Types: n/a Description: Airsonic 10.2.1 uses Spring's default remember-me mechanism based on MD5, with a fixed key of airsonic in GlobalSecurityConfig.java. An attacker able to capture cookies might be able to trivially bruteforce offline the passwords of associated users. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/airsonic/airsonic/commit/3e07ea52885f88d3fbec444dfd592f27bfb65647
CVE ID: CVE-2019-10908 State: PUBLISHED Published: 2019-04-07T13:32:58 Last Updated: 2024-08-04T22:40:15.422Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Airsonic 10.2.1, RecoverController.java generates passwords via org.apache.commons.lang.RandomStringUtils, which uses java.util.Random internally. This PRNG has a 48-bit seed that can easily be bruteforced, leading to trivial privilege escalation attacks. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/airsonic/airsonic/commit/61c842923a6d60d4aedd126445a8437b53b752c8
CVE ID: CVE-2019-10909 State: PUBLISHED Published: 2019-05-16T21:36:10 Last Updated: 2024-08-04T22:40:15.086Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, validation messages are not escaped, which can lead to XSS when user input is included. This is related to symfony/framework-bundle. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/security/advisory/Synology_SA_19_19 - https://www.drupal.org/sa-core-2019-005 - https://symfony.com/blog/cve-2019-10909-escape-validation-messages-in-the-php-templating-engine - https://github.com/sy
https://symfony.com/blog/cve-2019-10909-escape-validation-messages-in-the-php-templating-engine - https://github.com/symfony/symfony/commit/ab4d05358c3d0dd1a36fc8c306829f68e3dd84e2
CVE ID: CVE-2019-10910 State: PUBLISHED Published: 2019-05-16T21:31:41 Last Updated: 2024-08-04T22:40:15.179Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, when service ids allow user input, this could allow for SQL Injection and remote code execution. This is related to symfony/dependency-injection. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/security/advisory/Synology_SA_19_19 - https://symfony.com/blog/cve-2019-10910-check-service-ids-are-valid - https://github.com/symfony/symfony/commit/d2fb5893923292a1da7985f0b56960b5bb10
-2019-10910-check-service-ids-are-valid - https://github.com/symfony/symfony/commit/d2fb5893923292a1da7985f0b56960b5bb10737b