Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-5088 State: PUBLISHED Published: 2019-11-05T20:29:34 Last Updated: 2024-08-04T19:47:56.667Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Investintech.com Inc. Products: Able2Extract Professional Problem Types: CWE-787 Description: An exploitable memory corruption vulnerability exists in Investintech Able2Extract Professional 14.0.7 x64. A specially crafted BMP file can cause an out-of-bounds memory write, allowing a potential attacker to execute arbitrary code on the victim machine. Can trigger this vulnerability by sending the user a specially crafted BMP file. Additional Analyst Notes: - CVE Program Container: References: - https://talosi
g the user a specially crafted BMP file. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0880
CVE ID: CVE-2019-5089 State: PUBLISHED Published: 2019-11-05T20:42:16 Last Updated: 2024-08-04T19:47:56.083Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Investintech Inc. Products: Able2Extract Professional Problem Types: CWE-190 Description: An exploitable memory corruption vulnerability exists in Investintech Able2Extract Professional 4.0.7 x64. A specially crafted JPEG file can cause an out-of-bounds memory write, allowing an attacker to execute arbitrary code on the victim machine. An attacker could exploit a vulnerability by providing the user with a specially crafted JPEG file. Additional Analyst Notes: - CVE Program Container: References: - https://
g the user with a specially crafted JPEG file. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0881
CVE ID: CVE-2019-5090 State: PUBLISHED Published: 2019-12-11T23:40:09 Last Updated: 2024-08-04T19:47:55.975Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) Vendors: n/a Products: LEADTOOLS libltdic.so Problem Types: CWE-125 Description: An exploitable information disclosure vulnerability exists in the DICOM packet-parsing functionality of LEADTOOLS libltdic.so, version 20.0.2019.3.15. A specially crafted packet can cause an out-of-bounds read, resulting in information disclosure. An attacker can send a packet to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-201
onal Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0882
CVE ID: CVE-2019-5091 State: PUBLISHED Published: 2019-12-11T23:46:56 Last Updated: 2024-08-04T19:47:56.254Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: n/a Products: LEADTOOLS libltdic.so Problem Types: CWE-835 Description: An exploitable denial-of-service vulnerability exists in the Dicom-packet parsing functionality of LEADTOOLS libltdic.so version 20.0.2019.3.15. A specially crafted packet can cause an infinite loop, resulting in a denial of service. An attacker can send a packet to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0883
CVE ID: CVE-2019-5092 State: PUBLISHED Published: 2019-12-11T23:47:33 Last Updated: 2024-08-04T19:47:55.957Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: LEADTOOLS Problem Types: CWE-787 Description: An exploitable heap out of bounds write vulnerability exists in the UI tag parsing functionality of the DICOM image format of LEADTOOLS 20.0.2019.3.15. A specially crafted DICOM image can cause an offset beyond the bounds of a heap allocation to be written, potentially resulting in code execution. An attacker can specially craft a DICOM image to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://ta
a DICOM image to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0884
CVE ID: CVE-2019-5093 State: PUBLISHED Published: 2019-12-11T23:40:13 Last Updated: 2024-08-04T19:47:55.946Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: LEADTOOLS libltdic.so Problem Types: CWE-190 Description: An exploitable code execution vulnerability exists in the DICOM network response functionality of LEADTOOLS libltdic.so version 20.0.2019.3.15. A specially crafted packet can cause an integer overflow, resulting in heap corruption. An attacker can send a packet to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0885
CVE ID: CVE-2019-5094 State: PUBLISHED Published: 2019-09-24T21:21:27.000Z Last Updated: 2025-05-30T19:48:11.112Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: E2fsprogs Problem Types: CWE-787 Description: An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.debian.org/security/2019/dsa-4535 - https://lists.debian.org/de
iner: - CISA ADP Vulnrichment: References: - https://www.debian.org/security/2019/dsa-4535 - https://lists.debian.org/debian-lts-announce/2019/09/msg00029.html - https://seclists.org/bugtraq/2019/Sep/58 - https://usn.ubuntu.com/4142-2/ - https://usn.ubuntu.com/4142-1/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2AKETJ6BREDUHRWQTV35SPGG5C6H7KSI/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6DOBCYQKCTTWXBLMUPJ5TX3FY7JNCOKY/ - https://security.gentoo.org/glsa/202003-05 - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0887 - https://security.netapp.com/advisory/ntap-202001
- https://talosintelligence.com/vulnerability_reports/TALOS-2019-0887 - https://security.netapp.com/advisory/ntap-20200115-0002/
CVE ID: CVE-2019-5095 State: PUBLISHED Published: 2019-10-31T19:51:08 Last Updated: 2024-08-04T19:47:56.033Z Vendors: n/a Products: Atlassian Problem Types: missing authorization Description: An issue summary information disclosure vulnerability exists in Atlassian Jira Tempo plugin, version 4.10.0. Authenticated users can obtain the summary for issues they do not have permission to view via the Tempo plugin. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0838
CVE ID: CVE-2019-5096 State: PUBLISHED Published: 2019-12-03T21:52:15 Last Updated: 2024-08-04T19:47:55.928Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: EmbedThis Problem Types: CWE-416 Description: An exploitable code execution vulnerability exists in the processing of multi-part/form-data requests within the base GoAhead web server application in versions v5.0.1, v.4.1.1 and v3.6.5. A specially crafted HTTP request can lead to a use-after-free condition during the processing of this request that can be used to corrupt heap structures that could lead to full code execution. The request can be unauthenticated in the form of GET or POST re
heap structures that could lead to full code execution. The request can be unauthenticated in the form of GET or POST requests, and does not require the requested resource to exist on the server. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0888
CVE ID: CVE-2019-5097 State: PUBLISHED Published: 2019-12-03T21:49:38 Last Updated: 2024-08-04T19:47:56.843Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: n/a Products: EmbedThis Problem Types: CWE-835 Description: A denial-of-service vulnerability exists in the processing of multi-part/form-data requests in the base GoAhead web server application in versions v5.0.1, v.4.1.1 and v3.6.5. A specially crafted HTTP request can lead to an infinite loop in the process. The request can be unauthenticated in the form of GET or POST requests and does not require the requested resource to exist on the server. Additional Analyst Notes: - CVE Program Container: Refere
oes not require the requested resource to exist on the server. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0889
CVE ID: CVE-2019-5098 State: PUBLISHED Published: 2019-12-05T17:24:07 Last Updated: 2024-08-04T19:47:56.039Z Vendors: n/a Products: AMD ATI Problem Types: Out of bounds read Description: An exploitable out-of-bounds read vulnerability exists in AMD ATIDXX64.DLL driver, version 26.20.13001.29010. A specially crafted pixel shader can cause out-of-bounds memory read. An attacker can provide a specially crafted shader file to trigger this vulnerability. This vulnerability can be triggered from VMware guest, affecting VMware host. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0890
CVE ID: CVE-2019-5099 State: PUBLISHED Published: 2019-11-06T19:34:34 Last Updated: 2024-08-04T19:47:55.948Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: LEADTOOLS Problem Types: CWE-191 Description: An exploitable integer underflow vulnerability exists in the CMP-parsing functionality of LEADTOOLS 20. A specially crafted CMP image file can cause an integer underflow, potentially resulting in code execution. An attacker can specially craft a CMP image to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0891
CVE ID: CVE-2019-5100 State: PUBLISHED Published: 2019-11-06T19:35:57 Last Updated: 2024-08-04T19:47:56.741Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: LEADTOOLS Problem Types: CWE-190 Description: An exploitable integer overflow vulnerability exists in the BMP header parsing functionality of LEADTOOLS 20. A specially crafted BMP image file can cause an integer overflow, potentially resulting in code execution. An attacker can specially craft a BMP image to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0892
CVE ID: CVE-2019-5101 State: PUBLISHED Published: 2019-11-18T17:59:12 Last Updated: 2024-08-04T19:47:55.716Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: OpenWRT Products: OpenWRT Problem Types: CWE-295 Description: An exploitable information leak vulnerability exists in the ustream-ssl library of OpenWrt, versions 18.06.4 and 15.05.1. When connecting to a remote server, the server's SSL certificate is checked but no action is taken when the certificate is invalid. An attacker could exploit this behavior by performing a man-in-the-middle attack, providing any certificate, leading to the theft of all the data sent by the client during the first request.An ex
ttack, providing any certificate, leading to the theft of all the data sent by the client during the first request.An exploitable information leak vulnerability exists in the ustream-ssl library of OpenWrt, versions 18.06.4 and 15.05.1. When connecting to a remote server, the server's SSL certificate is checked but no action is taken when the certificate is invalid. An attacker could exploit this behavior by performing a man-in-the-middle attack, providing any certificate, leading to the theft of all the data sent by the client during the first request. After an SSL connection is initialized via _ustream_ssl_init, and after any data (e.g. the client's HTTP request) is written to the stream u
ion is initialized via _ustream_ssl_init, and after any data (e.g. the client's HTTP request) is written to the stream using ustream_printf, the code eventually enters the function _ustream_ssl_poll, which is used to dispatch the read/write events Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0893
CVE ID: CVE-2019-5102 State: PUBLISHED Published: 2019-11-18T17:59:30 Last Updated: 2024-08-04T19:47:56.183Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: OpenWRT Products: OpenWRT Problem Types: CWE-295 Description: An exploitable information leak vulnerability exists in the ustream-ssl library of OpenWrt, versions 18.06.4 and 15.05.1. When connecting to a remote server, the server's SSL certificate is checked but no action is taken when the certificate is invalid. An attacker could exploit this behavior by performing a man-in-the-middle attack, providing any certificate, leading to the theft of all the data sent by the client during the first request.An ex
ttack, providing any certificate, leading to the theft of all the data sent by the client during the first request.An exploitable information leak vulnerability exists in the ustream-ssl library of OpenWrt, versions 18.06.4 and 15.05.1. When connecting to a remote server, the server's SSL certificate is checked but no action is taken when the certificate is invalid. An attacker could exploit this behavior by performing a man-in-the-middle attack, providing any certificate, leading to the theft of all the data sent by the client during the first request. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0893
CVE ID: CVE-2019-5104 State: REJECTED Published: 2020-03-19T14:53:37 Last Updated: 2020-03-19T14:53:37 Description: No description available.
CVE ID: CVE-2019-5105 State: PUBLISHED Published: 2020-03-26T14:12:10 Last Updated: 2024-08-04T19:47:56.219Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: n/a Products: 3S Problem Types: CWE-119 Description: An exploitable memory corruption vulnerability exists in the Name Service Client functionality of 3S-Smart Software Solutions CODESYS GatewayService. A specially crafted packet can cause a large memcpy, resulting in an access violation and termination of the process. An attacker can send a packet to a device running the GatewayService.exe to trigger this vulnerability. All variants of the CODESYS V3 products in all versions prior V3.5.16.10 containing th
xe to trigger this vulnerability. All variants of the CODESYS V3 products in all versions prior V3.5.16.10 containing the CmpRouter or CmpRouterEmbedded component are affected, regardless of the CPU type or operating system: CODESYS Control for BeagleBone, CODESYS Control for emPC-A/iMX6, CODESYS Control for IOT2000, CODESYS Control for Linux, CODESYS Control for PLCnext, CODESYS Control for PFC100, CODESYS Control for PFC200, CODESYS Control for Raspberry Pi, CODESYS Control RTE V3, CODESYS Control RTE V3 (for Beckhoff CX), CODESYS Control Win V3 (also part of the CODESYS Development System setup), CODESYS Control V3 Runtime System Toolkit, CODESYS V3 Embedded Target Visu Toolkit, CODESYS V
Development System setup), CODESYS Control V3 Runtime System Toolkit, CODESYS V3 Embedded Target Visu Toolkit, CODESYS V3 Remote Target Visu Toolkit, CODESYS V3 Safety SIL2, CODESYS Edge Gateway V3, CODESYS Gateway V3, CODESYS HMI V3, CODESYS OPC Server V3, CODESYS PLCHandler SDK, CODESYS V3 Simulation Runtime (part of the CODESYS Development System). Additional Analyst Notes: - CVE Program Container: References: - https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=13077&token=3bfc6d1d08415a6260b96093520071f5786e7fd4&download= - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0897
CVE ID: CVE-2019-5106 State: PUBLISHED Published: 2020-03-10T23:41:32 Last Updated: 2024-08-04T19:47:55.965Z Vendors: Wago Products: WAGO e!Cockpit Problem Types: Use of a Broken or Risky Cryptographic Algorithm Description: A hard-coded encryption key vulnerability exists in the authentication functionality of WAGO e!Cockpit version 1.5.1.1. An attacker with access to communications between e!Cockpit and CoDeSyS Gateway can trivially recover the password of any user attempting to log in, in plain text. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0898
CVE ID: CVE-2019-5107 State: PUBLISHED Published: 2020-03-10T23:41:29 Last Updated: 2024-08-04T19:47:56.719Z Vendors: Wago Products: WAGO e!Cockpit Problem Types: Cleartext Transmission of Sensitive Information Description: A cleartext transmission vulnerability exists in the network communication functionality of WAGO e!Cockpit version 1.5.1.1. An attacker with access to network traffic can easily intercept, interpret, and manipulate data coming from, or destined for e!Cockpit. This includes passwords, configurations, and binaries being transferred to endpoints. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2019-08
Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0899
CVE ID: CVE-2019-5108 State: PUBLISHED Published: 2019-12-23T18:55:05 Last Updated: 2024-08-04T19:47:56.112Z Severity: HIGH (CVSS 7.4 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: n/a Products: Linux kernel Problem Types: CWE-440 Description: An exploitable denial-of-service vulnerability exists in the Linux kernel prior to mainline 5.3. An attacker could exploit this vulnerability by triggering AP to send IAPP location updates for stations before the required authentication process has completed. This could lead to different denial-of-service scenarios, either by causing CAM table attacks, or by leading to traffic flapping if faking already existing clients in other nearby APs of t
causing CAM table attacks, or by leading to traffic flapping if faking already existing clients in other nearby APs of the same wireless infrastructure. An attacker can forge Authentication and Association Request packets to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/4285-1/ - https://usn.ubuntu.com/4287-1/ - https://usn.ubuntu.com/4286-2/ - https://usn.ubuntu.com/4287-2/ - https://usn.ubuntu.com/4286-1/ - https://lists.debian.org/debian-lts-announce/2020/06/msg00011.html - https://lists.debian.org/debian-lts-announce/2020/06/msg00012.html - https://lists.debian.org/debian-lts-announce/2020/06/msg00013.html - https://ww
ian-lts-announce/2020/06/msg00012.html - https://lists.debian.org/debian-lts-announce/2020/06/msg00013.html - https://www.debian.org/security/2020/dsa-4698 - https://www.oracle.com/security-alerts/cpuApr2021.html - https://security.netapp.com/advisory/ntap-20200204-0002/ - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0900 - https://git.kernel.org/linus/3e493173b7841259a08c5c8e5cbe90adb349da7e - http://packetstormsecurity.com/files/156455/Kernel-Live-Patch-Security-Notice-LSN-0063-1.html
CVE ID: CVE-2019-5109 State: PUBLISHED Published: 2019-12-03T21:43:16 Last Updated: 2024-08-04T19:47:56.716Z Severity: HIGH (CVSS 7.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L) Vendors: n/a Products: Forma Problem Types: CWE-89 Description: Exploitable SQL injection vulnerabilities exists in the authenticated portion of Forma LMS 2.2.1. Specially crafted web requests can cause SQL injections. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability, potentially allowing exfiltration of the database, user credentials and, in certain configurations, access the underlying operating system. Additional Analyst Notes: - CVE Program Contai
s and, in certain configurations, access the underlying operating system. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0902
CVE ID: CVE-2019-5110 State: PUBLISHED Published: 2019-12-03T21:44:17 Last Updated: 2024-08-04T19:47:56.674Z Severity: HIGH (CVSS 7.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L) Vendors: n/a Products: Forma Problem Types: CWE-89 Description: Exploitable SQL injection vulnerabilities exist in the authenticated portion of Forma LMS 2.2.1. Specially crafted web requests can cause SQL injections. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability, potentially allowing exfiltration of the database, user credentials and, in certain configurations, access the underlying operating system. Additional Analyst Notes: - CVE Program Contain
and, in certain configurations, access the underlying operating system. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0903
CVE ID: CVE-2019-5111 State: PUBLISHED Published: 2019-12-03T21:37:54 Last Updated: 2024-08-04T19:47:56.757Z Severity: HIGH (CVSS 7.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L) Vendors: n/a Products: Forma Problem Types: CWE-89 Description: Exploitable SQL injection vulnerability exists in the authenticated portion of Forma LMS 2.2.1. The /appLms/ajax.server.php URL and parameter filter_cat was confirmed to suffer from SQL injections and could be exploited by authenticated attackers. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability, potentially allowing exfiltration of the database, user credentials and, in certain configura
rigger this vulnerability, potentially allowing exfiltration of the database, user credentials and, in certain configurations, access the underlying operating system. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0904
CVE ID: CVE-2019-5112 State: PUBLISHED Published: 2019-12-03T21:38:14 Last Updated: 2024-08-04T19:47:56.082Z Severity: HIGH (CVSS 7.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L) Vendors: n/a Products: Forma Problem Types: CWE-89 Description: Exploitable SQL injection vulnerability exists in the authenticated portion of Forma LMS 2.2.1. The /appLms/ajax.server.php URL and parameter filter_status was confirmed to suffer from SQL injections and could be exploited by authenticated attackers. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability, potentially allowing exfiltration of the database, user credentials and, in certain config
o trigger this vulnerability, potentially allowing exfiltration of the database, user credentials and, in certain configurations, access the underlying operating system. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0904
CVE ID: CVE-2019-5114 State: PUBLISHED Published: 2019-10-25T17:25:49 Last Updated: 2024-08-04T19:47:56.210Z Severity: HIGH (CVSS 7.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L) Vendors: n/a Products: YouPHPTube Problem Types: CWE-89 Description: An exploitable SQL injection vulnerability exists in the authenticated portion of YouPHPTube 7.6. Specially crafted web requests can cause SQL injections. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability, potentially allowing exfiltration of the database, user credentials and,in certain configuration, access the underlying operating system. Additional Analyst Notes: - CVE Program Con
ntials and,in certain configuration, access the underlying operating system. Additional Analyst Notes: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2019-0906