Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-12571 State: PUBLISHED Published: 2019-07-11T19:45:24 Last Updated: 2024-08-04T23:24:38.951Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v0.9.8 beta (build 02099) for macOS could allow an authenticated, local attacker to overwrite arbitrary files. When the client initiates a connection, the XML /tmp/pia-watcher.plist file is created. If the file exists, it will be truncated and the contents completely overwritten. This file is removed on disconnect. An unprivileged user can create a hard or soft link to arbitrary files owned by any user on the system, including root. This create
eged user can create a hard or soft link to arbitrary files owned by any user on the system, including root. This creates a denial of service condition and possible data loss if leveraged by a malicious local user. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mirchr/security-research/blob/master/vulnerabilities/PIA/CVE-2019-12571.txt
CVE ID: CVE-2019-12572 State: PUBLISHED Published: 2019-06-21T17:51:16 Last Updated: 2024-08-04T23:24:39.151Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client 1.0.2 (build 02363) for Windows could allow an authenticated, local attacker to run arbitrary code with elevated privileges. On startup, the PIA Windows service (pia-service.exe) loads the OpenSSL library from %PROGRAMFILES%\Private Internet Access\libeay32.dll. This library attempts to load the C:\etc\ssl\openssl.cnf configuration file which does not exist. By default on Windows systems, authenticated users can create directories under C:\. A
ation file which does not exist. By default on Windows systems, authenticated users can create directories under C:\. A low privileged user can create a C:\etc\ssl\openssl.cnf configuration file to load a malicious OpenSSL engine library resulting in arbitrary code execution as SYSTEM when the service starts. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mirchr/security-research/blob/master/vulnerabilities/PIA/CVE-2019-12572.txt - https://blog.mirch.io/2019/06/10/cve-2019-12572-pia-windows-privilege-escalation-malicious-openssl-engine/
CVE ID: CVE-2019-12573 State: PUBLISHED Published: 2019-07-11T19:31:02 Last Updated: 2024-08-04T23:24:38.899Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for Linux and macOS could allow an authenticated, local attacker to overwrite arbitrary files. The openvpn_launcher binary is setuid root. This binary supports the --log option, which accepts a path as an argument. This parameter is not sanitized, which allows a local unprivileged user to overwrite arbitrary files owned by any user on the system, including root. This creates a denial of service condition and possible data loss if leveraged
any user on the system, including root. This creates a denial of service condition and possible data loss if leveraged by a malicious local user. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mirchr/security-research/blob/master/vulnerabilities/PIA/CVE-2019-12573.txt
CVE ID: CVE-2019-12574 State: PUBLISHED Published: 2019-07-11T19:55:46 Last Updated: 2024-08-04T23:24:38.598Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v1.0 for Windows could allow an authenticated, local attacker to run arbitrary code with elevated privileges. The PIA client is vulnerable to a DLL injection vulnerability during the software update process. The updater loads several libraries from a folder that authenticated users have write access to. A low privileged user can leverage this vulnerability to execute arbitrary code as SYSTEM. Additional Analyst Notes: - CVE Program Container: R
an leverage this vulnerability to execute arbitrary code as SYSTEM. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mirchr/security-research/blob/master/vulnerabilities/PIA/CVE-2019-12574.txt
CVE ID: CVE-2019-12575 State: PUBLISHED Published: 2019-07-11T19:19:50 Last Updated: 2024-08-04T23:24:39.199Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for Linux could allow an authenticated, local attacker to run arbitrary code with elevated privileges. The root_runner.64 binary is setuid root. This binary executes /opt/pia/ruby/64/ruby, which in turn attempts to load several libraries under /tmp/ruby-deploy.old/lib. A local unprivileged user can create a malicious library under this path to execute arbitrary code as the root user. Additional Analyst Notes: - CVE Program Container: Refere
ry under this path to execute arbitrary code as the root user. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mirchr/security-research/blob/master/vulnerabilities/PIA/CVE-2019-12575.txt
CVE ID: CVE-2019-12576 State: PUBLISHED Published: 2019-07-11T19:34:40 Last Updated: 2024-08-04T23:24:38.543Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for macOS could allow an authenticated, local attacker to run arbitrary code with elevated privileges. The openvpn_launcher binary is setuid root. This program is called during the connection process and executes several operating system utilities to configure the system. The networksetup utility is called using relative paths. A local unprivileged user can execute arbitrary commands as root by creating a networksetup trojan which will be e
aths. A local unprivileged user can execute arbitrary commands as root by creating a networksetup trojan which will be executed during the connection process. This is possible because the PATH environment variable is not reset prior to executing the OS utility. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mirchr/security-research/blob/master/vulnerabilities/PIA/CVE-2019-12576.txt
CVE ID: CVE-2019-12577 State: PUBLISHED Published: 2019-07-11T19:27:59 Last Updated: 2024-08-04T23:24:38.897Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for macOS could allow an authenticated, local attacker to run arbitrary code with elevated privileges. The macOS binary openvpn_launcher.64 is setuid root. This binary creates /tmp/pia_upscript.sh when executed. Because the file creation mask (umask) is not reset, the umask value is inherited from the calling process. This value can be manipulated to cause the privileged binary to create files with world writable permissions. A local unpriv
value can be manipulated to cause the privileged binary to create files with world writable permissions. A local unprivileged user can modify /tmp/pia_upscript.sh during the connect process to execute arbitrary code as the root user. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mirchr/security-research/blob/master/vulnerabilities/PIA/CVE-2019-12577.txt
CVE ID: CVE-2019-12578 State: PUBLISHED Published: 2019-07-11T19:51:31 Last Updated: 2024-08-04T23:24:39.226Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for Linux could allow an authenticated, local attacker to run arbitrary code with elevated privileges. The openvpn_launcher.64 binary is setuid root. This binary executes /opt/pia/openvpn-64/openvpn, passing the parameters provided from the command line. Care was taken to programmatically disable potentially dangerous openvpn parameters; however, the --route-pre-down parameter can be used. This parameter accepts an arbitrary path to a scrip
vpn parameters; however, the --route-pre-down parameter can be used. This parameter accepts an arbitrary path to a script/program to be executed when OpenVPN exits. The --script-security parameter also needs to be passed to allow for this action to be taken, and --script-security is not currently in the disabled parameter list. A local unprivileged user can pass a malicious script/binary to the --route-pre-down option, which will be executed as root when openvpn is stopped. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mirchr/security-research/blob/master/vulnerabilities/PIA/CVE-2019-12578.txt
CVE ID: CVE-2019-12579 State: PUBLISHED Published: 2019-07-11T19:24:30 Last Updated: 2024-08-04T23:24:38.950Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for Linux and macOS could allow an authenticated, local attacker to run arbitrary code with elevated privileges. The PIA Linux/macOS binary openvpn_launcher.64 binary is setuid root. This binary accepts several parameters to update the system configuration. These parameters are passed to operating system commands using a "here" document. The parameters are not sanitized, which allow for arbitrary commands to be injected using shell metachar
here" document. The parameters are not sanitized, which allow for arbitrary commands to be injected using shell metacharacters. A local unprivileged user can pass special crafted parameters that will be interpolated by the operating system calls. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mirchr/security-research/blob/master/vulnerabilities/PIA/CVE-2019-12579.txt
CVE ID: CVE-2019-12581 State: PUBLISHED Published: 2019-06-27T14:10:08 Last Updated: 2024-08-04T23:24:39.189Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflective Cross-site scripting (XSS) vulnerability in the free_time_failed.cgi CGI program in selected Zyxel ZyWall, USG, and UAG devices allows remote attackers to inject arbitrary web script or HTML via the err_msg parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.zyxel.com/us/en/ - https://www.zyxel.com/support/vulnerabilities-related-to-the-Free-Time-feature.shtml - https://sec-consult.com/en/blog/advisories/reflected-cross-site-scripting-in-zxel-zywall/index.html - https://n-thuma
- https://sec-consult.com/en/blog/advisories/reflected-cross-site-scripting-in-zxel-zywall/index.html - https://n-thumann.de/blog/zyxel-gateways-missing-access-control-in-account-generator-xss/
CVE ID: CVE-2019-12582 State: REJECTED Published: 2019-06-03T12:05:06 Last Updated: 2019-06-03T12:05:06 Description: No description available.
CVE ID: CVE-2019-12583 State: PUBLISHED Published: 2019-06-27T14:01:02 Last Updated: 2024-08-04T23:24:39.316Z Vendors: n/a Products: n/a Problem Types: n/a Description: Missing Access Control in the "Free Time" component of several Zyxel UAG, USG, and ZyWall devices allows a remote attacker to generate guest accounts by directly accessing the account generator. This can lead to unauthorised network access or Denial of Service. Additional Analyst Notes: - CVE Program Container: References: - https://www.zyxel.com/support/vulnerabilities-related-to-the-Free-Time-feature.shtml - https://n-thumann.de/blog/zyxel-gateways-missing-access-control-in-account-generator-xss/
CVE ID: CVE-2019-12584 State: PUBLISHED Published: 2019-06-03T02:27:47 Last Updated: 2024-08-04T23:24:39.165Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apcupsd 0.3.91_5, as used in pfSense through 2.4.4-RELEASE-p3 and other products, has an XSS issue in apcupsd_status.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pfsense/FreeBSD-ports/commit/b492c0ea47aba8dde2f14183e71498ba207594e3 - https://redmine.pfsense.org/issues/9556 - https://ctrsec.io/index.php/2019/05/28/cve-2019-12584-12585-command-injection-vulnerability-on-pfsense-2-4-4-release-p3/
CVE ID: CVE-2019-12585 State: PUBLISHED Published: 2019-06-03T02:28:08 Last Updated: 2024-08-04T23:24:38.689Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apcupsd 0.3.91_5, as used in pfSense through 2.4.4-RELEASE-p3 and other products, has an Arbitrary Command Execution issue in apcupsd_status.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pfsense/FreeBSD-ports/commit/b492c0ea47aba8dde2f14183e71498ba207594e3 - https://redmine.pfsense.org/issues/9556 - https://ctrsec.io/index.php/2019/05/28/cve-2019-12584-12585-command-injection-vulnerability-on-pfsense-2-4-4-release-p3/
CVE ID: CVE-2019-12586 State: PUBLISHED Published: 2019-09-04T20:00:45 Last Updated: 2024-08-04T23:24:38.851Z Vendors: n/a Products: n/a Problem Types: n/a Description: The EAP peer implementation in Espressif ESP-IDF 2.0.0 through 4.0.0 and ESP8266_NONOS_SDK 2.2.0 through 3.1.0 processes EAP Success messages before any EAP method completion or failure, which allows attackers in radio range to cause a denial of service (crash) via a crafted message. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/espressif - https://github.com/Matheus-Garbelini/esp32_esp8266_attacks - https://matheus-garbelini.github.io/home/post/esp32-esp8266-eap-crash/
CVE ID: CVE-2019-12587 State: PUBLISHED Published: 2019-09-04T11:31:48 Last Updated: 2024-08-04T23:24:38.689Z Vendors: n/a Products: n/a Problem Types: n/a Description: The EAP peer implementation in Espressif ESP-IDF 2.0.0 through 4.0.0 and ESP8266_NONOS_SDK 2.2.0 through 3.1.0 allows the installation of a zero Pairwise Master Key (PMK) after the completion of any EAP authentication method, which allows attackers in radio range to replay, decrypt, or spoof frames via a rogue access point. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/espressif - https://github.com/Matheus-Garbelini/esp32_esp8266_attacks - https://matheus-garbelini.github.io/home/post/ze
spressif - https://github.com/Matheus-Garbelini/esp32_esp8266_attacks - https://matheus-garbelini.github.io/home/post/zero-pmk-installation/
CVE ID: CVE-2019-12588 State: PUBLISHED Published: 2019-09-04T11:30:13 Last Updated: 2024-08-04T23:24:38.700Z Vendors: n/a Products: n/a Problem Types: n/a Description: The client 802.11 mac implementation in Espressif ESP8266_NONOS_SDK 2.2.0 through 3.1.0 does not validate correctly the RSN AuthKey suite list count in beacon frames, probe responses, and association responses, which allows attackers in radio range to cause a denial of service (crash) via a crafted message. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/espressif - https://github.com/Matheus-Garbelini/esp32_esp8266_attacks - https://matheus-garbelini.github.io/home/post/esp8266-beacon-fram
//github.com/Matheus-Garbelini/esp32_esp8266_attacks - https://matheus-garbelini.github.io/home/post/esp8266-beacon-frame-crash/
CVE ID: CVE-2019-12589 State: PUBLISHED Published: 2019-06-03T03:00:21 Last Updated: 2024-08-04T23:24:39.186Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Firejail before 0.9.60, seccomp filters are writable inside the jail, leading to a lack of intended seccomp restrictions for a process that is joined to the jail after a filter has been modified by an attacker. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/netblue30/firejail/issues/2718 - https://github.com/netblue30/firejail/commit/eecf35c2f8249489a1d3e512bb07f0d427183134 - https://github.com/netblue30/firejail/releases/tag/0.9.60 - https://lists.fedoraproject.org/archives/list/packag
83134 - https://github.com/netblue30/firejail/releases/tag/0.9.60 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CDY7B73YDRBURA25APSHD5PFEO4TNSFW/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGVULJ6IKVDO6UAVIQRHQVSKOUD6QDWM/
CVE ID: CVE-2019-12591 State: PUBLISHED Published: 2019-06-03T12:35:50 Last Updated: 2024-08-04T23:24:38.610Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AC:H/AV:N/A:L/C:H/I:L/PR:H/S:C/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: NETGEAR Insight Cloud with firmware before Insight 5.6 allows remote authenticated users to achieve command injection. Additional Analyst Notes: - CVE Program Container: References: - https://kb.netgear.com/000060977/Security-Advisory-for-Post-Authentication-Command-Injection-on-Insight-Cloud-PSV-2018-0366
CVE ID: CVE-2019-12592 State: PUBLISHED Published: 2019-06-18T20:38:59 Last Updated: 2024-08-04T23:24:39.119Z Vendors: n/a Products: n/a Problem Types: n/a Description: A universal Cross-site scripting (UXSS) vulnerability in the Evernote Web Clipper extension before 7.11.1 for Chrome allows remote attackers to run arbitrary web script or HTML in the context of any loaded 3rd-party IFrame. Additional Analyst Notes: - CVE Program Container: References: - https://www.cyberscoop.com/evernote-patches-flaw-google-chrome-extension/ - https://www.techrepublic.com/article/evernote-chrome-extension-vulnerability-allowed-attackers-to-steal-4-7m-users-data/
CVE ID: CVE-2019-12593 State: PUBLISHED Published: 2019-06-03T16:41:07 Last Updated: 2024-08-04T23:24:38.796Z Vendors: n/a Products: n/a Problem Types: n/a Description: IceWarp Mail Server through 10.4.4 is prone to a local file inclusion vulnerability via webmail/calendar/minimizer/index.php?style=..%5c directory traversal. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/JameelNabbo/exploits/blob/master/IceWarp%20%3C%3D10.4.4%20local%20file%20include.txt - http://packetstormsecurity.com/files/153161/IceWarp-10.4.4-Local-File-Inclusion.html
CVE ID: CVE-2019-12594 State: PUBLISHED Published: 2019-07-02T16:07:42 Last Updated: 2024-08-04T23:24:38.687Z Vendors: n/a Products: n/a Problem Types: n/a Description: DOSBox 0.74-2 has Incorrect Access Control. Additional Analyst Notes: - CVE Program Container: References: - https://www.dosbox.com/crew.php - https://security-tracker.debian.org/tracker/CVE-2019-12594 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=931222 - https://lists.debian.org/debian-lts-announce/2019/07/msg00004.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PYV27Z3QZTDHUZJLW3LDJYO7HBVIMJ5F/ - https://www.debian.org/security/2019/dsa-4478 - https://seclists.o
oject.org/message/PYV27Z3QZTDHUZJLW3LDJYO7HBVIMJ5F/ - https://www.debian.org/security/2019/dsa-4478 - https://seclists.org/bugtraq/2019/Jul/14 - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00047.html - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00053.html
CVE ID: CVE-2019-12595 State: PUBLISHED Published: 2019-07-11T13:14:05 Last Updated: 2024-08-04T23:24:39.150Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via the RCSettings.do rdsName parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/products/asset-explorer/sp-readme.html - https://github.com/tarantula-team/Multiple-Cross-Site-Scripting-vulnerabilities-in-Zoho-ManageEngine - http://www.securityfocus.com/bid/109364
CVE ID: CVE-2019-12596 State: PUBLISHED Published: 2019-07-11T13:13:03 Last Updated: 2024-08-04T23:24:39.050Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via SoftwareListView.do with the parameter swType or swComplianceType. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/products/asset-explorer/sp-readme.html - https://github.com/tarantula-team/Multiple-Cross-Site-Scripting-vulnerabilities-in-Zoho-ManageEngine - http://www.securityfocus.com/bid/109364
CVE ID: CVE-2019-12597 State: PUBLISHED Published: 2019-07-11T13:10:22 Last Updated: 2024-08-04T23:24:38.612Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via ResourcesAttachments.jsp with the parameter pageName. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/products/asset-explorer/sp-readme.html - https://github.com/tarantula-team/Multiple-Cross-Site-Scripting-vulnerabilities-in-Zoho-ManageEngine - http://www.securityfocus.com/bid/109364
CVE ID: CVE-2019-12598 State: PUBLISHED Published: 2019-06-07T17:36:56 Last Updated: 2024-08-04T23:24:39.215Z Vendors: n/a Products: n/a Problem Types: n/a Description: SuiteCRM 7.8.x before 7.8.30, 7.10.x before 7.10.17, and 7.11.x before 7.11.5 allows SQL Injection (issue 1 of 3). Additional Analyst Notes: - CVE Program Container: References: - https://docs.suitecrm.com/admin/releases/7.11.x/#_7_11_5
CVE ID: CVE-2019-12599 State: PUBLISHED Published: 2019-06-07T17:38:30 Last Updated: 2024-08-04T23:24:38.596Z Vendors: n/a Products: n/a Problem Types: n/a Description: SuiteCRM 7.10.x before 7.10.17 and 7.11.x before 7.11.5 allows SQL Injection. Additional Analyst Notes: - CVE Program Container: References: - https://docs.suitecrm.com/admin/releases/7.11.x/#_7_11_5
CVE ID: CVE-2019-12600 State: PUBLISHED Published: 2019-06-07T17:35:06 Last Updated: 2024-08-04T23:24:39.166Z Vendors: n/a Products: n/a Problem Types: n/a Description: SuiteCRM 7.8.x before 7.8.30, 7.10.x before 7.10.17, and 7.11.x before 7.11.5 allows SQL Injection (issue 2 of 3). Additional Analyst Notes: - CVE Program Container: References: - https://docs.suitecrm.com/admin/releases/7.11.x/#_7_11_5
CVE ID: CVE-2019-12601 State: PUBLISHED Published: 2019-06-07T17:33:14 Last Updated: 2024-08-04T23:24:38.679Z Vendors: n/a Products: n/a Problem Types: n/a Description: SuiteCRM 7.8.x before 7.8.30, 7.10.x before 7.10.17, and 7.11.x before 7.11.5 allows SQL Injection (issue 3 of 3). Additional Analyst Notes: - CVE Program Container: References: - https://docs.suitecrm.com/admin/releases/7.11.x/#_7_11_5
CVE ID: CVE-2019-12611 State: PUBLISHED Published: 2019-10-17T18:55:04 Last Updated: 2024-08-04T23:24:38.680Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Bitdefender BOX firmware versions before 2.1.37.37-34 that affects the general reliability of the product. Specially crafted packets sent to the miniupnpd implementation in result in the device allocating memory without freeing it later. This behavior can cause the miniupnpd component to crash or to trigger a device reboot. Additional Analyst Notes: - CVE Program Container: References: - https://www.bitdefender.com/support/security-advisories/bitdefender-box-denial-service-va-3184/
CVE ID: CVE-2019-12612 State: PUBLISHED Published: 2019-10-31T16:02:53 Last Updated: 2024-08-04T23:24:38.783Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Bitdefender BOX firmware versions before 2.1.37.37-34 that allows an attacker to pass arbitrary code to the BOX appliance via the web API. In order to exploit this vulnerability, an attacker needs presence in Bitdefender BOX setup network and Bitdefender BOX be in setup mode. Additional Analyst Notes: - CVE Program Container: References: - https://www.bitdefender.com/support/security-advisories/bitdefender-box-local-code-execution/
CVE ID: CVE-2019-12613 State: REJECTED Published: 2019-07-29T14:29:05 Last Updated: 2019-07-29T14:29:05 Description: No description available.