Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-18929 State: PUBLISHED Published: 2019-11-13T15:50:18 Last Updated: 2024-08-05T02:02:39.866Z Vendors: n/a Products: n/a Problem Types: n/a Description: Western Digital My Cloud EX2 Ultra firmware 2.31.183 allows web users (including guest accounts) to remotely execute arbitrary code via a download_mgr.cgi stack-based buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/DelspoN/CVE/blob/master/CVE-2019-18929/description.txt - https://github.com/DelspoN/CVE/tree/master/CVE-2019-18929
CVE ID: CVE-2019-18930 State: PUBLISHED Published: 2019-11-13T15:47:08 Last Updated: 2024-08-05T02:02:39.856Z Vendors: n/a Products: n/a Problem Types: n/a Description: Western Digital My Cloud EX2 Ultra firmware 2.31.183 allows web users (including guest account) to remotely execute arbitrary code via a stack-based buffer overflow. There is no size verification logic in one of functions in libscheddl.so, and download_mgr.cgi makes it possible to enter large-sized f_idx inputs. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/DelspoN/CVE/blob/master/CVE-2019-18930/description.txt - https://github.com/DelspoN/CVE/tree/master/CVE-2019-18930
CVE ID: CVE-2019-18931 State: PUBLISHED Published: 2019-11-13T15:34:46 Last Updated: 2024-08-05T02:02:39.820Z Vendors: n/a Products: n/a Problem Types: n/a Description: Western Digital My Cloud EX2 Ultra firmware 2.31.195 allows a Buffer Overflow with Extended Instruction Pointer (EIP) control via crafted GET/POST parameters. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/DelspoN/CVE/tree/master/CVE-2019-18931 - https://github.com/DelspoN/CVE/blob/master/CVE-2019-18931/description.txt
CVE ID: CVE-2019-18932 State: PUBLISHED Published: 2020-01-21T17:52:21 Last Updated: 2024-08-05T02:02:39.854Z Vendors: n/a Products: n/a Problem Types: n/a Description: log.c in Squid Analysis Report Generator (sarg) through 2.3.11 allows local privilege escalation. By default, it uses a fixed temporary directory /tmp/sarg. As the root user, sarg creates this directory or reuses an existing one in an insecure manner. An attacker can pre-create the directory, and place symlinks in it (after winning a /tmp/sarg/denied.int_unsort race condition). The outcome will be corrupted or newly created files in privileged file system locations. Additional Analyst Notes: - CVE Program Container: Reference
or newly created files in privileged file system locations. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=1150554 - https://sourceforge.net/projects/sarg/ - http://www.openwall.com/lists/oss-security/2020/01/20/6 - http://www.openwall.com/lists/oss-security/2020/01/20/6 - https://seclists.org/oss-sec/2020/q1/23 - http://www.openwall.com/lists/oss-security/2020/01/27/1 - http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00051.html - http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00063.html - https://security.gentoo.org/glsa/202007-32
CVE ID: CVE-2019-18933 State: PUBLISHED Published: 2019-11-21T22:45:15 Last Updated: 2024-08-05T02:02:39.793Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Zulip Server versions from 1.7.0 to before 2.0.7, a bug in the new user signup process meant that users who registered their account using social authentication (e.g., GitHub or Google SSO) in an organization that also allows password authentication could have their personal API key stolen by an unprivileged attacker, allowing nearly full access to the user's account. Additional Analyst Notes: - CVE Program Container: References: - https://blog.zulip.org/2019/11/21/zulip-2-0-7-security-release/ - https://github.com/zulip/z
am Container: References: - https://blog.zulip.org/2019/11/21/zulip-2-0-7-security-release/ - https://github.com/zulip/zulip/commit/0c2cc41d2e40807baa5ee2c72987ebfb64ea2eb6
CVE ID: CVE-2019-18934 State: PUBLISHED Published: 2019-11-19T17:30:01 Last Updated: 2024-08-05T02:02:39.825Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unbound 1.6.4 through 1.9.4 contain a vulnerability in the ipsec module that can cause shell code execution after receiving a specially crafted answer. This issue can only be triggered if unbound was compiled with `--enable-ipsecmod` support, and ipsecmod is enabled and used in the configuration. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/11/19/1 - https://www.nlnetlabs.nl/downloads/unbound/CVE-2019-18934.txt - https://github.com/NLnetLabs/unbound/blob/rele
11/19/1 - https://www.nlnetlabs.nl/downloads/unbound/CVE-2019-18934.txt - https://github.com/NLnetLabs/unbound/blob/release-1.9.5/doc/Changelog - https://www.nlnetlabs.nl/news/2019/Nov/19/unbound-1.9.5-released/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MOCR6JP7MSRARTOGEHGST64G4FJGX5VK/ - http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00069.html - http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00067.html
CVE ID: CVE-2019-18935 State: PUBLISHED Published: 2019-12-11T00:00:00.000Z Last Updated: 2025-10-21T23:35:56.289Z Vendors: n/a Products: n/a Problem Types: n/a Description: Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function. This is exploitable when the encryption keys are known due to the presence of CVE-2017-11317 or CVE-2017-11357, or other means. Exploitation can result in remote code execution. (As of 2020.1.114, a default setting prevents the exploit. In 2019.3.1023, but not earlier versions, a non-default setting can prevent exploitation.) Additional Analyst Notes: - CVE Program Container: - CISA ADP V
rsions, a non-default setting can prevent exploitation.) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.telerik.com/support/whats-new/release-history - https://codewhitesec.blogspot.com/2019/02/telerik-revisited.html - https://www.telerik.com/support/kb/aspnet-ajax/details/allows-javascriptserializer-deserialization - https://github.com/bao7uo/RAU_crypto - https://know.bishopfox.com/research/cve-2019-18935-remote-code-execution-in-telerik-ui - https://github.com/noperator/CVE-2019-18935 - http://packetstormsecurity.com/files/155720/Telerik-UI-Remote-Code-Execution.html - https://www.telerik.com/support/whats-new/aspnet-ajax/release-histo
files/155720/Telerik-UI-Remote-Code-Execution.html - https://www.telerik.com/support/whats-new/aspnet-ajax/release-history/ui-for-asp-net-ajax-r1-2020-%28version-2020-1-114%29 - http://packetstormsecurity.com/files/159653/Telerik-UI-ASP.NET-AJAX-RadAsyncUpload-Deserialization.html - https://www.bleepingcomputer.com/news/security/us-federal-agency-hacked-using-old-telerik-bug-to-steal-data/
CVE ID: CVE-2019-18936 State: PUBLISHED Published: 2020-03-21T00:08:23 Last Updated: 2024-08-05T02:02:39.864Z Vendors: n/a Products: n/a Problem Types: n/a Description: UniValue::read() in UniValue before 1.0.5 allow attackers to cause a denial of service (the class internal data reaches an inconsistent state) via input data that triggers an error. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jgarzik/univalue/compare/v1.0.4...v1.0.5 - https://github.com/jgarzik/univalue/pull/58
CVE ID: CVE-2019-18937 State: PUBLISHED Published: 2019-11-14T18:50:42 Last Updated: 2024-08-05T02:02:39.918Z Vendors: n/a Products: n/a Problem Types: n/a Description: eQ-3 Homematic CCU2 2.47.20 and CCU3 3.47.18 with the Script Parser AddOn through 1.8 installed allow Remote Code Execution by unauthenticated attackers with access to the web interface via the exec.cgi script, which executes TCL script content from an HTTP POST request. Additional Analyst Notes: - CVE Program Container: References: - https://psytester.github.io/CVE-2019-18937/
CVE ID: CVE-2019-18938 State: PUBLISHED Published: 2019-11-14T18:52:33 Last Updated: 2024-08-05T02:02:39.909Z Vendors: n/a Products: n/a Problem Types: n/a Description: eQ-3 Homematic CCU2 2.47.20 and CCU3 3.47.18 with the E-Mail AddOn through 1.6.8.c installed allow Remote Code Execution by unauthenticated attackers with access to the web interface via the save.cgi script for payload upload and the testtcl.cgi script for its execution. Additional Analyst Notes: - CVE Program Container: References: - https://psytester.github.io/CVE-2019-18938/
CVE ID: CVE-2019-18939 State: PUBLISHED Published: 2019-11-14T18:53:08 Last Updated: 2024-08-05T02:02:39.744Z Vendors: n/a Products: n/a Problem Types: n/a Description: eQ-3 Homematic CCU2 2.47.20 and CCU3 3.47.18 with the HM-Print AddOn through 1.2a installed allow Remote Code Execution by unauthenticated attackers with access to the web interface via the exec.cgi and exec1.cgi scripts, which execute TCL script content from an HTTP POST request. Additional Analyst Notes: - CVE Program Container: References: - https://psytester.github.io/CVE-2019-18939/
CVE ID: CVE-2019-18942 State: PUBLISHED Published: 2021-02-26T03:30:59.295147Z Last Updated: 2024-09-16T20:52:31.849Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Micro Focus Products: Solutions Business Manager Problem Types: CWE-79 Description: Micro Focus Solutions Business Manager versions prior to 11.7.1 are vulnerable to stored XSS. The application reflects previously stored user input without encoding. Additional Analyst Notes: - CVE Program Container: References: - http://knowledgebase.serena.com/resources/sites/KNOWLEDGEBASE/content/live/SOLUTIONS/142000/S142001/en_US/sbm_11.7.1_security_bulletin.htm
CVE ID: CVE-2019-18943 State: PUBLISHED Published: 2021-02-26T03:32:59.312073Z Last Updated: 2024-09-16T19:10:13.603Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N) Vendors: Micro Focus Products: Solutions Business Manager Problem Types: CWE-611 Description: Micro Focus Solutions Business Manager versions prior to 11.7.1 are vulnerable to XML External Entity Processing (XXE) on certain operations. Additional Analyst Notes: - CVE Program Container: References: - http://knowledgebase.serena.com/resources/sites/KNOWLEDGEBASE/content/live/SOLUTIONS/142000/S142001/en_US/sbm_11.7.1_security_bulletin.htm
CVE ID: CVE-2019-18944 State: PUBLISHED Published: 2021-02-26T03:28:07.976209Z Last Updated: 2024-09-16T20:21:38.799Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: Micro Focus Products: Solutions Business Manager Problem Types: CWE-80 Description: Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to reflected XSS. Additional Analyst Notes: - CVE Program Container: References: - http://knowledgebase.serena.com/resources/sites/KNOWLEDGEBASE/content/live/SOLUTIONS/142000/S142001/en_US/sbm_11.7.1_security_bulletin.htm
CVE ID: CVE-2019-18945 State: PUBLISHED Published: 2021-02-26T03:12:06 Last Updated: 2024-08-05T02:02:39.887Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: Micro Focus Products: Solutions Business Manager Problem Types: CWE-264 Description: Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to privilege escalation vulnerability. Additional Analyst Notes: - CVE Program Container: References: - http://knowledgebase.serena.com/resources/sites/KNOWLEDGEBASE/content/live/SOLUTIONS/142000/S142001/en_US/sbm_11.7.1_security_bulletin.htm
CVE ID: CVE-2019-18946 State: PUBLISHED Published: 2021-02-26T03:04:38.890602Z Last Updated: 2024-09-16T17:28:42.698Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Micro Focus Products: Solutions Business Manager Problem Types: CWE-384 Description: Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to session fixation. Additional Analyst Notes: - CVE Program Container: References: - http://knowledgebase.serena.com/resources/sites/KNOWLEDGEBASE/content/live/SOLUTIONS/142000/S142001/en_US/sbm_11.7.1_security_bulletin.htm
CVE ID: CVE-2019-18947 State: PUBLISHED Published: 2021-02-26T03:07:45.666497Z Last Updated: 2024-09-16T16:58:52.188Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Micro Focus Products: Solutions Business Manager Problem Types: CWE-200 Description: Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to information disclosure. Additional Analyst Notes: - CVE Program Container: References: - http://knowledgebase.serena.com/resources/sites/KNOWLEDGEBASE/content/live/SOLUTIONS/142000/S142001/en_US/sbm_11.7.1_security_bulletin.htm
CVE ID: CVE-2019-18948 State: PUBLISHED Published: 2020-04-16T16:52:56 Last Updated: 2024-08-05T02:02:39.867Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was found in Arista EOS. Specific malformed ARP packets can impact the software forwarding of VxLAN packets. This issue is found in Arista’s EOS VxLAN code, which can allow attackers to crash the VxlanSwFwd agent. This affects EOS 4.21.8M and below releases in the 4.21.x train, 4.22.3M and below releases in the 4.22.x train, 4.23.1F and below releases in the 4.23.x train, and all releases in 4.15, 4.16, 4.17, 4.18, 4.19, 4.20 code train. Additional Analyst Notes: - CVE Program Container: References: - https://www.ari
.16, 4.17, 4.18, 4.19, 4.20 code train. Additional Analyst Notes: - CVE Program Container: References: - https://www.arista.com/en/support/advisories-notices/security-advisories/10292-security-advisory-47
CVE ID: CVE-2019-18949 State: PUBLISHED Published: 2019-11-14T02:30:09 Last Updated: 2024-08-05T02:02:39.863Z Vendors: n/a Products: n/a Problem Types: n/a Description: SnowHaze before 2.6.6 is sometimes too late to honor a per-site JavaScript blocking setting, which leads to unintended JavaScript execution via a chain of webpage redirections targeted to the user's browser configuration. Additional Analyst Notes: - CVE Program Container: References: - https://snowhaze.com/ssa.txt
CVE ID: CVE-2019-18951 State: PUBLISHED Published: 2019-11-13T22:38:07 Last Updated: 2024-08-05T02:02:39.864Z Vendors: n/a Products: n/a Problem Types: n/a Description: SibSoft Xfilesharing through 2.5.1 allows op=page&tmpl=../ directory traversal to read arbitrary files. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/pak0s/af9f640170aed335fdf6d110d468dbce - http://packetstormsecurity.com/files/155324/Xfilesharing-2.5.1-Local-File-Inclusion-Shell-Upload.html
CVE ID: CVE-2019-18952 State: PUBLISHED Published: 2019-11-13T22:38:17 Last Updated: 2024-08-05T02:02:39.901Z Vendors: n/a Products: n/a Problem Types: n/a Description: SibSoft Xfilesharing through 2.5.1 allows cgi-bin/up.cgi arbitrary file upload. This can be combined with CVE-2019-18951 to achieve remote code execution via a .html file, containing short codes, that is served over HTTP. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/pak0s/af9f640170aed335fdf6d110d468dbce - http://packetstormsecurity.com/files/155324/Xfilesharing-2.5.1-Local-File-Inclusion-Shell-Upload.html
CVE ID: CVE-2019-18954 State: PUBLISHED Published: 2019-11-13T23:39:46 Last Updated: 2024-08-05T02:02:39.866Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pomelo v2.2.5 allows external control of critical state data. A malicious user input can corrupt arbitrary methods and attributes in template/game-server/app/servers/connector/handler/entryHandler.js because certain internal attributes can be overwritten via a conflicting name. Hence, a malicious attacker can manipulate internal attributes by adding additional attributes to user input. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cl0udz/vulnerabilities/tree/master/pomelo-critical-state-m
es: - CVE Program Container: References: - https://github.com/cl0udz/vulnerabilities/tree/master/pomelo-critical-state-manipulation - https://github.com/NetEase/pomelo/issues/1149
CVE ID: CVE-2019-18955 State: PUBLISHED Published: 2019-12-19T17:00:39 Last Updated: 2024-08-05T02:02:39.902Z Vendors: n/a Products: n/a Problem Types: n/a Description: The web console in Lansweeper 7.2.105.2 has XSS via the URL path. Product vulnerability has been fixed and disclosed within changelog as of 02 Dec 2019. Additional Analyst Notes: - CVE Program Container: References: - https://www.lansweeper.com/changelog/
CVE ID: CVE-2019-18956 State: PUBLISHED Published: 2019-12-17T15:08:14 Last Updated: 2024-08-05T02:02:39.931Z Vendors: n/a Products: n/a Problem Types: n/a Description: Divisa Proxia Suite 9 < 9.12.16, 9.11.19, 9.10.26, 9.9.8, 9.8.43 and 9.7.10, 10.0 < 10.0.32, and 10.1 < 10.1.5, SparkSpace 1.0 < 1.0.30, 1.1 < 1.1.2, and 1.2 < 1.2.4, and Proxia PHR 1.0 < 1.0.30 and 1.1 < 1.1.2 allows remote code execution via untrusted Java deserialization. The proxia-error cookie is insecurely deserialized in every request (GET or POST). Thus, an unauthenticated attacker can easily craft a seria1.0lized payload in order to execute arbitrary code via the prepareError function in the com.divisait.dv2ee.contro
seria1.0lized payload in order to execute arbitrary code via the prepareError function in the com.divisait.dv2ee.controller.MVCControllerServlet class of the dv2eemvc.jar component. allows remote code execution via untrusted Java deserialization. The proxia-error cookie is insecurely deserialized in every request (GET or POST). Thus, an unauthenticated attacker can easily craft a serialized payload in order to execute arbitrary code via the prepareError function in the com.divisait.dv2ee.controller.MVCControllerServlet class of the dv2eemvc.jar component. Affected products include Proxia Premium Edition 2017 and Sparkspace. Additional Analyst Notes: - CVE Program Container: References: - ht
include Proxia Premium Edition 2017 and Sparkspace. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/blackarrowsec/advisories/tree/master/2019/CVE-2019-18956
CVE ID: CVE-2019-18957 State: PUBLISHED Published: 2019-11-14T13:57:47 Last Updated: 2024-08-05T02:02:39.924Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microstrategy Library in MicroStrategy before 2019 before 11.1.3 has reflected XSS. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/155320/MicroStrategy-Library-Cross-Site-Scripting.html - https://seclists.org/bugtraq/2019/Nov/23 - http://seclists.org/fulldisclosure/2019/Nov/4
CVE ID: CVE-2019-18958 State: PUBLISHED Published: 2019-11-21T14:07:01 Last Updated: 2024-08-05T02:02:39.899Z Vendors: n/a Products: n/a Problem Types: n/a Description: Nitro Pro before 13.2 creates a debug.log file in the directory where a .pdf file is located, if the .pdf document was produced by an OCR operation on the JPEG output of a scanner. Reportedly, this can have a security risk if debug.log is later edited and then executed. Additional Analyst Notes: - CVE Program Container: References: - https://a-man-in-the-cookie.blogspot.com/2019/11/nitro-pro-vulnerability.html
CVE ID: CVE-2019-18960 State: PUBLISHED Published: 2019-12-11T12:25:02 Last Updated: 2024-08-05T02:02:39.930Z Vendors: n/a Products: n/a Problem Types: n/a Description: Firecracker vsock implementation buffer overflow in versions 0.18.0 and 0.19.0. This can result in potentially exploitable crashes. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/firecracker-microvm/firecracker/releases - http://www.openwall.com/lists/oss-security/2019/12/10/1 - https://github.com/firecracker-microvm/firecracker/issues/1462 - https://github.com/firecracker-microvm/firecracker/releases/tag/v0.19.1 - https://github.com/firecracker-microvm/firecracker/releases/tag/v0.18.1 - h
r-microvm/firecracker/releases/tag/v0.19.1 - https://github.com/firecracker-microvm/firecracker/releases/tag/v0.18.1 - http://www.openwall.com/lists/oss-security/2022/09/11/2
CVE ID: CVE-2019-18961 State: REJECTED Published: 2020-01-09T21:45:57 Last Updated: 2020-01-09T21:45:57 Description: No description available.
CVE ID: CVE-2019-18962 State: REJECTED Published: 2020-01-09T21:45:57 Last Updated: 2020-01-09T21:45:57 Description: No description available.
CVE ID: CVE-2019-18963 State: REJECTED Published: 2020-01-09T21:45:57 Last Updated: 2020-01-09T21:45:57 Description: No description available.
CVE ID: CVE-2019-18964 State: REJECTED Published: 2020-01-09T21:45:57 Last Updated: 2020-01-09T21:45:57 Description: No description available.
CVE ID: CVE-2019-18965 State: REJECTED Published: 2020-01-09T21:45:57 Last Updated: 2020-01-09T21:45:57 Description: No description available.
CVE ID: CVE-2019-18966 State: REJECTED Published: 2020-01-09T21:45:57 Last Updated: 2020-01-09T21:45:57 Description: No description available.
CVE ID: CVE-2019-18967 State: REJECTED Published: 2020-01-09T21:45:57 Last Updated: 2020-01-09T21:45:57 Description: No description available.
CVE ID: CVE-2019-18968 State: REJECTED Published: 2020-01-09T21:45:57 Last Updated: 2020-01-09T21:45:57 Description: No description available.
CVE ID: CVE-2019-18969 State: REJECTED Published: 2020-01-09T21:45:57 Last Updated: 2020-01-09T21:45:57 Description: No description available.
CVE ID: CVE-2019-18970 State: REJECTED Published: 2020-01-09T21:45:57 Last Updated: 2020-01-09T21:45:57 Description: No description available.
CVE ID: CVE-2019-18976 State: PUBLISHED Published: 2019-11-22T16:59:19 Last Updated: 2024-08-05T02:02:39.983Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in res_pjsip_t38.c in Sangoma Asterisk through 13.x and Certified Asterisk through 13.21-x. If it receives a re-invite initiating T.38 faxing and has a port of 0 and no c line in the SDP, a NULL pointer dereference and crash will occur. This is different from CVE-2019-18940. Additional Analyst Notes: - CVE Program Container: References: - https://www.asterisk.org/downloads/security-advisories - https://www.cybersecurity-help.cz/vdb/SB2019112218?affChecked=1 - https://packetstormsecurity.com/files/15543
visories - https://www.cybersecurity-help.cz/vdb/SB2019112218?affChecked=1 - https://packetstormsecurity.com/files/155436/Asterisk-Project-Security-Advisory-AST-2019-008.html - https://seclists.org/fulldisclosure/2019/Nov/20 - http://downloads.asterisk.org/pub/security/AST-2019-008.html - https://lists.debian.org/debian-lts-announce/2022/04/msg00001.html
CVE ID: CVE-2019-18978 State: PUBLISHED Published: 2019-11-14T20:21:24 Last Updated: 2024-08-05T02:02:39.801Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the rack-cors (aka Rack CORS Middleware) gem before 1.0.4 for Ruby. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cyu/rack-cors/commit/e4d4fc362a4315808927011cbe5afcfe5486f17d - https://github.com/cyu/rack-cors/compare/v1.0.3...v1.0.4 - https://lists.debian.org/debian-lts-announce/2020/02/msg00004.html - https://lists.
/rack-cors/compare/v1.0.3...v1.0.4 - https://lists.debian.org/debian-lts-announce/2020/02/msg00004.html - https://lists.debian.org/debian-lts-announce/2020/10/msg00000.html - https://usn.ubuntu.com/4571-1/ - https://www.debian.org/security/2021/dsa-4918
CVE ID: CVE-2019-18979 State: PUBLISHED Published: 2020-03-18T20:25:28 Last Updated: 2024-08-05T02:02:39.850Z Vendors: n/a Products: n/a Problem Types: n/a Description: Adaware antivirus 12.6.1005.11662 and 12.7.1055.0 has a quarantine flaw that allows privilege escalation. Exploitation uses an NTFS directory junction to restore a malicious DLL from quarantine into the system32 folder. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40kusolwatcharaapanukorn/0-days-adaware-antivirus-quarantine-flaws-allow-privilege-escalation-3d1f3c8214ec