Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
78e59ee59c7dc841c7fbd83d0769285b41e948%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/r70b1ff22ee80e8101805b9a473116dd33265709007d2deb6f8c80bf2%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/rff210a24f3a924829790e69eaefa84820902b7b31f17c3bf2def9114%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/ra9fbfe7d4830ae675bf34c7c0f8c22fc8a4099f65706c1bc4f54c593%40%3Cissues.zookeeper.apache.org%3E - https://lists.apache.org/thread.html/r96e08f929234e8ba1ef4a93a0fd2870f535a1f9ab628fabc46115986%40%3Cdev.zookeeper.apache.org%3E - https://lists.apache.org/thread.html/r81700644754e66ffea465c869cb477de25f8041e21598e8818fc2c45%40%3Cdev
.apache.org%3E - https://lists.apache.org/thread.html/r81700644754e66ffea465c869cb477de25f8041e21598e8818fc2c45%40%3Cdev.zookeeper.apache.org%3E - https://lists.apache.org/thread.html/r804895eedd72c9ec67898286eb185e04df852b0dd5fe53cf5b6138f9%40%3Cissues.zookeeper.apache.org%3E - https://lists.apache.org/thread.html/rce71d33747010d32d31d90f5d737dae26291d96552f513a266c92fbb%40%3Cnotifications.zookeeper.apache.org%3E - https://lists.apache.org/thread.html/rfb55f245b08d8a6ec0fb4dc159022227cd22de34c4419c2fbb18802b%40%3Cnotifications.zookeeper.apache.org%3E - https://lists.apache.org/thread.html/ra2ace4bcb5cf487f72cbcbfa0f8cc08e755ec2b93d7e69f276148b08%40%3Cissues.zookeeper.apache.org%3E - https:/
.org/thread.html/ra2ace4bcb5cf487f72cbcbfa0f8cc08e755ec2b93d7e69f276148b08%40%3Cissues.zookeeper.apache.org%3E - https://lists.apache.org/thread.html/r36fcf538b28f2029e8b4f6b9a772f3b107913a78f09b095c5b153a62%40%3Cissues.zookeeper.apache.org%3E - https://lists.apache.org/thread.html/r310d2ce22304d5298ff87f10134f918c87919b452734f9841d95682d%40%3Ccommits.zookeeper.apache.org%3E - https://lists.apache.org/thread.html/r9b20cdac704cf9a583400350e2d5b576fa8417c18ddb961201676c60%40%3Ccommits.zookeeper.apache.org%3E - https://lists.apache.org/thread.html/r640eb9b3213058a963e18291f903fc1584e577f60035f941e32f760a%40%3Cissues.zookeeper.apache.org%3E - https://lists.apache.org/thread.html/r1fcccf8bdb3531c
fc1584e577f60035f941e32f760a%40%3Cissues.zookeeper.apache.org%3E - https://lists.apache.org/thread.html/r1fcccf8bdb3531c28bc9aa605a6a1bea7e68cef6fc12e01faafb2fb5%40%3Cissues.zookeeper.apache.org%3E - https://lists.apache.org/thread.html/r819aaeb9944bdcfca438dcc51f05650dc728daf64dfd7d774fc2499b%40%3Ccommits.zookeeper.apache.org%3E - https://lists.apache.org/thread.html/rb84c57670ec48ef23f4d07973b7fa69f629b8e7fcfb48874362feb6f%40%3Ccommits.zookeeper.apache.org%3E - https://lists.apache.org/thread.html/r6945f3c346b7af89bbd3526a7c9b705b1e3569070ebcd0964bcedd7d%40%3Cissues.zookeeper.apache.org%3E - https://access.redhat.com/errata/RHSA-2020:0497 - https://lists.apache.org/thread.html/r959474dcf7f
eper.apache.org%3E - https://access.redhat.com/errata/RHSA-2020:0497 - https://lists.apache.org/thread.html/r959474dcf7f88565ed89f6252ca5a274419006cb71348f14764b183d%40%3Ccommits.cassandra.apache.org%3E - https://lists.debian.org/debian-lts-announce/2020/02/msg00017.html - https://lists.debian.org/debian-lts-announce/2020/02/msg00018.html - https://access.redhat.com/errata/RHSA-2020:0601 - https://access.redhat.com/errata/RHSA-2020:0606 - https://access.redhat.com/errata/RHSA-2020:0605 - https://access.redhat.com/errata/RHSA-2020:0567 - https://lists.apache.org/thread.html/rb5c065e7bd701b0744f9f28ad769943f91745102716c1eb516325f11%40%3Cissues.spark.apache.org%3E - https://lists.apache.org/thr
rb5c065e7bd701b0744f9f28ad769943f91745102716c1eb516325f11%40%3Cissues.spark.apache.org%3E - https://lists.apache.org/thread.html/r46f93de62b1e199f3f9babb18128681677c53493546f532ed88c359d%40%3Creviews.spark.apache.org%3E - https://access.redhat.com/errata/RHSA-2020:0806 - https://access.redhat.com/errata/RHSA-2020:0811 - https://access.redhat.com/errata/RHSA-2020:0804 - https://access.redhat.com/errata/RHSA-2020:0805 - https://lists.apache.org/thread.html/r205937c85817a911b0c72655c2377e7a2c9322d6ef6ce1b118d34d8d%40%3Cdev.geode.apache.org%3E - https://lists.apache.org/thread.html/ra1a71b576a45426af5ee65255be9596ff3181a342f4ba73b800db78f%40%3Cdev.geode.apache.org%3E - https://lists.apache.org/t
html/ra1a71b576a45426af5ee65255be9596ff3181a342f4ba73b800db78f%40%3Cdev.geode.apache.org%3E - https://lists.apache.org/thread.html/r4ff40646e9ccce13560458419accdfc227b8b6ca4ead3a8a91decc74%40%3Cissues.flume.apache.org%3E - https://lists.apache.org/thread.html/r030beff88aeb6d7a2d6cd21342bd18686153ce6e26a4171d0e035663%40%3Cissues.flume.apache.org%3E - https://lists.apache.org/thread.html/rbdb59c683d666130906a9c05a1d2b034c4cc08cda7ed41322bd54fe2%40%3Cissues.flume.apache.org%3E - https://lists.apache.org/thread.html/r4d3f1d3e333d9c2b2f6e6ae8ed8750d4de03410ac294bcd12c7eefa3%40%3Ccommits.cassandra.apache.org%3E - https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444
Ccommits.cassandra.apache.org%3E - https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E - https://lists.debian.org/debian-lts-announce/2020/09/msg00004.html - https://lists.debian.org/debian-lts-announce/2020/09/msg00003.html - https://lists.apache.org/thread.html/raaac04b7567c554786132144bea3dcb72568edd410c1e6f0101742e7%40%3Cissues.flink.apache.org%3E - https://lists.apache.org/thread.html/rf5b2dfb7401666a19915f8eaef3ba9f5c3386e2066fcd2ae66e16a2f%40%3Cdev.flink.apache.org%3E - https://usn.ubuntu.com/4532-1/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TS6VX7OM
.com/4532-1/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TS6VX7OMXPDJIU5LRGUAHRK6MENAVJ46/ - https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E - https://lists.apache.org/thread.html/r832724df393a7ef25ca4c7c2eb83ad2d6c21c74569acda5233f9f1ec%40%3Ccommits.pulsar.apache.org%3E - https://lists.apache.org/thread.html/r7790b9d99696d9eddce8a8c96f13bb68460984294ea6fea3800143e4%40%3Ccommits.pulsar.apache.org%3E - https://lists.apache.org/thread.html/rdb69125652311d0c41f6066ff44072a3642cf33a4b5e3c4f9c1ec9c2%40%3Ccommits.pulsar.apache.org%3E - https://www.debian.org/secur
b69125652311d0c41f6066ff44072a3642cf33a4b5e3c4f9c1ec9c2%40%3Ccommits.pulsar.apache.org%3E - https://www.debian.org/security/2021/dsa-4885 - https://lists.apache.org/thread.html/rd8f72411fb75b98d366400ae789966373b5c3eb3f511e717caf3e49e%40%3Cissues.flink.apache.org%3E - https://lists.apache.org/thread.html/r2f2989b7815d809ff3fda8ce330f553e5f133505afd04ffbc135f35f%40%3Cissues.spark.apache.org%3E
CVE ID: CVE-2019-20446 State: PUBLISHED Published: 2020-02-02T00:00:00 Last Updated: 2024-08-05T02:39:09.924Z Vendors: n/a Products: n/a Problem Types: n/a Description: In xml.rs in GNOME librsvg before 2.46.2, a crafted SVG file with nested patterns can cause denial of service when passed to the library for processing. The attacker constructs pattern elements so that the number of final rendered objects grows exponentially. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.gnome.org/GNOME/librsvg/issues/515 - http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00024.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedora
-security-announce/2020-03/msg00024.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X3B5RWJQD5LA45MYLLR55KZJOJ5NVZGP/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6IOHSO6BUKC6I66J5PZOMAGFVJ66ZS57/ - https://lists.debian.org/debian-lts-announce/2020/07/msg00016.html - https://usn.ubuntu.com/4436-1/ - https://security.netapp.com/advisory/ntap-20221111-0004/
CVE ID: CVE-2019-20447 State: PUBLISHED Published: 2020-02-05T19:22:07 Last Updated: 2024-08-05T02:39:10.033Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jobberbase 2.0 has SQL injection via the PATH_INFO to the jobs-in endpoint. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/47311 - https://packetstormsecurity.com/files/152503/Jobberbase-CMS-2.0-SQL-Injection.html
CVE ID: CVE-2019-20451 State: PUBLISHED Published: 2020-02-10T14:39:06 Last Updated: 2024-08-05T02:39:10.097Z Vendors: n/a Products: n/a Problem Types: n/a Description: The HTTP API in Prismview System 9 11.10.17.00 and Prismview Player 11 13.09.1100 allows remote code execution by uploading RebootSystem.lnk and requesting /REBOOTSYSTEM or /RESTARTVNC. (Authentication is required but an XML file containing credentials can be downloaded.) Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/papers/47535
CVE ID: CVE-2019-20452 State: PUBLISHED Published: 2020-03-17T13:56:00 Last Updated: 2024-08-05T02:39:10.136Z Vendors: n/a Products: n/a Problem Types: n/a Description: A problem was found in Pydio Core before 8.2.4 and Pydio Enterprise before 8.2.4. A PHP object injection is present in the page plugins/core.access/src/RecycleBinManager.php. An authenticated user with basic privileges can inject objects and achieve remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://pydio.com/en/community/releases/pydio-core/pydio-core-pydio-enterprise-824-security-release - https://www.certilience.fr/2020/03/cve-2019-20452-vulnerabilite-php-object-injection-pydio-
prise-824-security-release - https://www.certilience.fr/2020/03/cve-2019-20452-vulnerabilite-php-object-injection-pydio-core/
CVE ID: CVE-2019-20453 State: PUBLISHED Published: 2020-03-17T13:56:58 Last Updated: 2024-08-05T02:39:09.929Z Vendors: n/a Products: n/a Problem Types: n/a Description: A problem was found in Pydio Core before 8.2.4 and Pydio Enterprise before 8.2.4. A PHP object injection is present in the page plugins/uploader.http/HttpDownload.php. An authenticated user with basic privileges can inject objects and achieve remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://pydio.com/en/community/releases/pydio-core/pydio-core-pydio-enterprise-824-security-release - https://www.certilience.fr/2020/03/cve-2019-20453-vulnerabilite-php-object-injection-pydio-core/
CVE ID: CVE-2019-20454 State: PUBLISHED Published: 2020-02-14T00:00:00 Last Updated: 2024-08-05T02:39:09.902Z Severity: MEDIUM (CVSS 5.1 CVSS:3.0/AC:H/AV:L/A:H/C:N/I:N/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An out-of-bounds read was discovered in PCRE before 10.34 when the pattern \X is JIT compiled and used to match specially crafted subjects in non-UTF mode. Applications that use PCRE to parse untrusted input may be vulnerable to this flaw, which would allow an attacker to crash the application. The flaw occurs in do_extuni_no_utf in pcre2_jit_compile.c. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.exim.org/show_bug.cgi?id
e2_jit_compile.c. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.exim.org/show_bug.cgi?id=2421 - https://bugs.php.net/bug.php?id=78338 - https://vcs.pcre.org/pcre2?view=revision&revision=1092 - https://bugzilla.redhat.com/show_bug.cgi?id=1735494 - https://security.gentoo.org/glsa/202006-16 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OQRAHYHLRNMBTPR3KXVM27NSZP3KTOPI/ - https://lists.debian.org/debian-lts-announce/2023/03/msg00014.html
CVE ID: CVE-2019-20455 State: PUBLISHED Published: 2020-02-14T15:43:53 Last Updated: 2024-08-05T02:39:10.091Z Vendors: n/a Products: n/a Problem Types: n/a Description: Gateways/Gateway.php in Heartland & Global Payments PHP SDK before 2.0.0 does not enforce SSL certificate validations. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/globalpayments/php-sdk/releases/tag/2.0.0 - https://github.com/globalpayments/php-sdk/compare/1.3.3...2.0.0 - https://winterdragon.ca/global-payments-vulnerability/ - https://github.com/globalpayments/php-sdk/pull/8
CVE ID: CVE-2019-20456 State: PUBLISHED Published: 2020-02-16T19:00:22 Last Updated: 2024-08-05T02:39:09.936Z Vendors: n/a Products: n/a Problem Types: n/a Description: Goverlan Reach Console before 9.50, Goverlan Reach Server before 3.50, and Goverlan Client Agent before 9.20.50 have an Untrusted Search Path that leads to Command Injection and Local Privilege Escalation via DLL hijacking. Additional Analyst Notes: - CVE Program Container: References: - https://www.goverlan.com/knowledge/article/security-advisory-govsa-2019-1028-1-local-privilege-escalation-2/
CVE ID: CVE-2019-20457 State: PUBLISHED Published: 2024-11-07T00:00:00.000Z Last Updated: 2025-11-04T17:11:56.231Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Brother MFC-J491DW C1806180757 devices. The printer's web-interface password hash can be retrieved without authentication, because the response header of any failed login attempt returns an incomplete authorization cookie. The value of the authorization cookie is the MD5 hash of the password in hexadecimal. An attacker can easily derive the true MD5 hash from this, and use offline cracking attacks to obtain administrative access to the device. Additional Analyst Notes: - CISA ADP Vulnrichment:
line cracking attacks to obtain administrative access to the device. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://global.brother - https://support.brother.com/g/s/security/en/index.html - https://seclists.org/fulldisclosure/2024/Jul/14
CVE ID: CVE-2019-20458 State: PUBLISHED Published: 2024-11-07T00:00:00.000Z Last Updated: 2025-11-04T17:11:57.636Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Epson Expression Home XP255 20.08.FM10I8 devices. By default, the device comes (and functions) without a password. The user is at no point prompted to set up a password on the device (leaving a number of devices without a password). In this case, anyone connecting to the web admin panel is capable of becoming admin without using any credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://epson.com/Support/wa00826 - https://seclists.org/full
A ADP Vulnrichment: - CVE Program Container: References: - https://epson.com/Support/wa00826 - https://seclists.org/fulldisclosure/2024/Jul/14
CVE ID: CVE-2019-20459 State: PUBLISHED Published: 2024-11-07T00:00:00.000Z Last Updated: 2025-11-04T17:11:59.010Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Epson Expression Home XP255 20.08.FM10I8 devices. With the SNMPv1 public community, all values can be read, and with the epson community, all the changeable values can be written/updated, as demonstrated by permanently disabling the network card or changing the DNS servers. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://epson.com/Support/wa00826 - https://seclists.org/fulldisclosure/2024/Jul/14
CVE ID: CVE-2019-20460 State: PUBLISHED Published: 2024-11-07T00:00:00.000Z Last Updated: 2025-11-04T17:12:00.488Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Epson Expression Home XP255 20.08.FM10I8 devices. POST requests don't require (anti-)CSRF tokens or other mechanisms for validating that the request is from a legitimate source. In addition, CSRF attacks can be used to send text directly to the RAW printer interface. For example, an attack could deliver a worrisome printout to an end user. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://epson.com/Support/wa00826 - https://seclists.org/fulldisclo
Vulnrichment: - CVE Program Container: References: - https://epson.com/Support/wa00826 - https://seclists.org/fulldisclosure/2024/Jul/14
CVE ID: CVE-2019-20461 State: PUBLISHED Published: 2024-11-07T00:00:00.000Z Last Updated: 2025-11-04T17:12:03.542Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Alecto IVM-100 2019-11-12 devices. The device uses a custom UDP protocol to start and control video and audio services. The protocol has been partially reverse engineered. Based upon the reverse engineering, no password or username is ever transferred over this protocol. Thus, one can set up the camera connection feed with only the encoded UID. It is possible to set up sessions with the camera over the Internet by using the encoded UID and the custom UDP protocol, because authentication happens
s with the camera over the Internet by using the encoded UID and the custom UDP protocol, because authentication happens at the client side. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.alecto.nl - https://seclists.org/fulldisclosure/2024/Jul/14
CVE ID: CVE-2019-20462 State: PUBLISHED Published: 2024-11-07T00:00:00.000Z Last Updated: 2025-11-04T17:12:04.995Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Alecto IVM-100 2019-11-12 devices. The device comes with a serial interface at the board level. By attaching to this serial interface and rebooting the device, a large amount of information is disclosed. This includes the view password and the password of the Wi-Fi access point that the device used. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.alecto.nl - https://seclists.org/fulldisclosure/2024/Jul/14
CVE ID: CVE-2019-20463 State: PUBLISHED Published: 2021-04-02T15:30:35 Last Updated: 2024-08-05T02:39:10.105Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Sannce Smart HD Wifi Security Camera EAN 2 950004 595317 devices. A crash and reboot can be triggered by crafted IP traffic, as demonstrated by the Nikto vulnerability scanner. For example, sending the 111111 string to UDP port 20188 causes a reboot. To deny service for a long time period, the crafted IP traffic may be sent periodically. Additional Analyst Notes: - CVE Program Container: References: - https://www.eurofins-cybersecurity.com/news/connected-devices-baby-monitors-part-2/ - http://seclis
ainer: References: - https://www.eurofins-cybersecurity.com/news/connected-devices-baby-monitors-part-2/ - http://seclists.org/fulldisclosure/2024/Jul/14
CVE ID: CVE-2019-20464 State: PUBLISHED Published: 2021-04-02T15:32:59 Last Updated: 2024-08-05T02:39:10.022Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Sannce Smart HD Wifi Security Camera EAN 2 950004 595317 devices. By default, a mobile application is used to stream over UDP. However, the device offers many more services that also enable streaming. Although the service used by the mobile application requires a password, the other streaming services do not. By initiating communication on the RTSP port, an attacker can obtain access to the video feed without authenticating. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container:
ss to the video feed without authenticating. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.eurofins-cybersecurity.com/news/connected-devices-baby-monitors-part-2/ - http://seclists.org/fulldisclosure/2024/Jul/14
CVE ID: CVE-2019-20465 State: PUBLISHED Published: 2021-04-02T15:35:03 Last Updated: 2024-08-05T02:39:10.086Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Sannce Smart HD Wifi Security Camera EAN 2 950004 595317 devices. It is possible (using TELNET without a password) to control the camera's pan/zoom/tilt functionality. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.eurofins-cybersecurity.com/news/connected-devices-baby-monitors-part-2/ - http://seclists.org/fulldisclosure/2024/Jul/14
CVE ID: CVE-2019-20466 State: PUBLISHED Published: 2021-04-02T15:37:05 Last Updated: 2024-08-05T02:39:09.901Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Sannce Smart HD Wifi Security Camera EAN 2 950004 595317 devices. A local attacker with the "default" account is capable of reading the /etc/passwd file, which contains a weakly hashed root password. By taking this hash and cracking it, the attacker can obtain root rights on the device. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.eurofins-cybersecurity.com/news/connected-devices-baby-monitors-part-2/ - http://seclists.org/fulldisclosure/2024/
//www.eurofins-cybersecurity.com/news/connected-devices-baby-monitors-part-2/ - http://seclists.org/fulldisclosure/2024/Jul/14
CVE ID: CVE-2019-20467 State: PUBLISHED Published: 2021-07-22T12:37:51 Last Updated: 2024-08-05T02:39:10.227Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Sannce Smart HD Wifi Security Camera EAN 2 950004 595317 devices. The device by default has a TELNET interface available (which is not advertised or functionally used, but is nevertheless available). Two backdoor accounts (root and default) exist that can be used on this interface. The usernames and passwords of the backdoor accounts are the same on all devices. Attackers can use these backdoor accounts to obtain access and execute code as root within the device. Additional Analyst Notes: - CVE Prog
hese backdoor accounts to obtain access and execute code as root within the device. Additional Analyst Notes: - CVE Program Container: References: - https://www.sannce.com - https://www.eurofins-cybersecurity.com/news/connected-devices-baby-monitors-part-2/ - http://seclists.org/fulldisclosure/2024/Jul/14
CVE ID: CVE-2019-20468 State: PUBLISHED Published: 2021-02-01T20:18:40 Last Updated: 2024-08-05T02:39:10.102Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in SeTracker2 for TK-Star Q90 Junior GPS horloge 3.1042.9.8656 devices. It has unnecessary permissions such as READ_EXTERNAL_STORAGE, WRITE_EXTERNAL_STORAGE, and READ_CONTACTS. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.tk-star.com - https://www.eurofins-cybersecurity.com/news/connected-devices-smart-watches/ - http://seclists.org/fulldisclosure/2024/Jul/14
CVE ID: CVE-2019-20469 State: PUBLISHED Published: 2024-11-07T00:00:00.000Z Last Updated: 2025-11-04T17:12:06.348Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on One2Track 2019-12-08 devices. Confidential information is needlessly stored on the smartwatch. Audio files are stored in .amr format, in the audior directory. An attacker who has physical access can retrieve all audio files by connecting via a USB cable. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.one2track.nl - https://seclists.org/fulldisclosure/2024/Jul/14
CVE ID: CVE-2019-20470 State: PUBLISHED Published: 2021-02-01T20:03:48 Last Updated: 2024-08-05T02:39:10.089Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on TK-Star Q90 Junior GPS horloge 3.1042.9.8656 devices. It performs actions based on certain SMS commands. This can be used to set up a voice communication channel from the watch to any telephone number, initiated by sending a specific SMS and using the default password, e.g., pw,<password>,call,<mobile_number> triggers an outbound call from the watch. The password is sometimes available because of CVE-2019-20471. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References:
able because of CVE-2019-20471. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.tk-star.com - https://www.eurofins-cybersecurity.com/news/connected-devices-smart-watches/ - http://seclists.org/fulldisclosure/2024/Jul/14