Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
813/Amcrest-Cameras-2.520.AC00.18.R-Unauthenticated-Audio-Streaming.html - https://us.dahuasecurity.com/wp-content/uploads/2019/08/Cybersecurity_2019-08-02.pdf - https://www.dahuasecurity.com/support/cybersecurity/details/627?us
CVE ID: CVE-2019-3949 State: PUBLISHED Published: 2019-07-09T17:18:31 Last Updated: 2024-08-04T19:26:27.676Z Vendors: Arlo Products: Basestation firmware Problem Types: Networking Misconfiguration Description: Arlo Basestation firmware 1.12.0.1_27940 and prior firmware contain a networking misconfiguration that allows access to restricted network interfaces. This could allow an attacker to upload or download arbitrary files and possibly execute malicious code on the device. Additional Analyst Notes: - CVE Program Container: References: - https://kb.arlo.com/000062274/Security-Advisory-for-Networking-Misconfiguration-and-Insufficient-UART-Protection-Mechanisms
CVE ID: CVE-2019-3950 State: PUBLISHED Published: 2019-07-09T17:18:56 Last Updated: 2024-08-04T19:26:27.578Z Vendors: Arlo Products: Basestation firmware Problem Types: Insufficient UART Protections Description: Arlo Basestation firmware 1.12.0.1_27940 and prior contain a hardcoded username and password combination that allows root access to the device when an onboard serial interface is connected to. Additional Analyst Notes: - CVE Program Container: References: - https://kb.arlo.com/000062274/Security-Advisory-for-Networking-Misconfiguration-and-Insufficient-UART-Protection-Mechanisms
CVE ID: CVE-2019-3951 State: PUBLISHED Published: 2019-12-12T20:32:10 Last Updated: 2024-08-04T19:26:27.479Z Vendors: n/a Products: Advantech WebAccess/SCADA Problem Types: CWE-121 Description: Advantech WebAccess before 8.4.3 allows unauthenticated remote attackers to execute arbitrary code or cause a denial of service (memory corruption) due to a stack-based buffer overflow when handling IOCTL 70533 RPC messages. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2019-52
CVE ID: CVE-2019-3953 State: PUBLISHED Published: 2019-06-18T22:53:01 Last Updated: 2024-08-04T19:26:27.492Z Vendors: n/a Products: Advantech WebAccess/SCADA Problem Types: Stack-based Buffer Overflow Description: Stack-based buffer overflow in Advantech WebAccess/SCADA 8.4.0 allows a remote, unauthenticated attacker to execute arbitrary code by sending a crafted IOCTL 10012 RPC call. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2019-17
CVE ID: CVE-2019-3954 State: PUBLISHED Published: 2019-06-18T23:16:31 Last Updated: 2024-08-04T19:26:27.557Z Vendors: n/a Products: Advantech WebAccess/SCADA Problem Types: Stack-based Buffer Overflow Description: Stack-based buffer overflow in Advantech WebAccess/SCADA 8.4.0 allows a remote, unauthenticated attacker to execute arbitrary code by sending a crafted IOCTL 81024 RPC call. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2019-28
CVE ID: CVE-2019-3955 State: PUBLISHED Published: 2019-06-07T20:00:55 Last Updated: 2024-08-04T19:26:27.899Z Vendors: n/a Products: Solarwinds Dameware Remote Mini Controller Problem Types: Unauth Remote Heap Buffer Overflow Description: Dameware Remote Mini Control version 12.1.0.34 and prior contains a unauthenticated remote heap overflow due to the server not properly validating RsaPubKeyLen during key negotiation. An unauthenticated remote attacker can cause a heap buffer overflow by specifying a large RsaPubKeyLen, which could cause a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2019-26
CVE ID: CVE-2019-3956 State: PUBLISHED Published: 2019-06-07T20:01:28 Last Updated: 2024-08-04T19:26:27.675Z Vendors: n/a Products: Solarwinds Dameware Remote Mini Controller Problem Types: Unauth Remote Buffer Over-read Description: Dameware Remote Mini Control version 12.1.0.34 and prior contains an unauthenticated remote buffer over-read due to the server not properly validating CltDHPubKeyLen during key negotiation, which could crash the application or leak sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2019-26
CVE ID: CVE-2019-3957 State: PUBLISHED Published: 2019-06-07T20:02:03 Last Updated: 2024-08-04T19:26:27.638Z Vendors: n/a Products: Solarwinds Dameware Remote Mini Controller Problem Types: Unauth Remote Buffer Over-read Description: Dameware Remote Mini Control version 12.1.0.34 and prior contains an unauthenticated remote buffer over-read due to the server not properly validating RsaSignatureLen during key negotiation, which could crash the application or leak sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2019-26
CVE ID: CVE-2019-3958 State: PUBLISHED Published: 2019-07-31T17:26:38 Last Updated: 2024-08-04T19:26:27.900Z Vendors: n/a Products: WallacePOS Problem Types: Authenticated Persistent Cross-site Scripting Description: Insufficient output sanitization in WallacePOS 1.4.3 allows a remote, authenticated attacker to conduct persistent cross-site scripting (XSS) attacks via a crafted sales transaction. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2019-37
CVE ID: CVE-2019-3959 State: PUBLISHED Published: 2019-07-31T17:22:38 Last Updated: 2024-08-04T19:26:27.587Z Vendors: n/a Products: WallacePOS Problem Types: Cross-site Request Forgery Description: Cross-site request forgery in WallacePOS 1.4.3 allows a remote attacker to perform sensitive application actions by tricking legitimate users into clicking a crafted link. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2019-37
CVE ID: CVE-2019-3960 State: PUBLISHED Published: 2019-07-31T17:20:04 Last Updated: 2024-08-04T19:26:27.915Z Vendors: n/a Products: WallacePOS Problem Types: Authenticated Unrestricted File Upload RCE Description: Unrestricted upload of file with dangerous type in WallacePOS 1.4.3 allows a remote, authenticated attacker to execute arbitrary code by uploading a malicious PHP file. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2019-37
CVE ID: CVE-2019-3961 State: PUBLISHED Published: 2019-06-25T20:27:56 Last Updated: 2024-08-04T19:26:27.660Z Vendors: Tenable Products: Tenable Nessus Problem Types: Cross-Site Scripting Description: Nessus versions 8.4.0 and earlier were found to contain a reflected XSS vulnerability due to improper validation of user-supplied input. An unauthenticated, remote attacker could potentially exploit this vulnerability via a specially crafted request to execute arbitrary script code in a users browser session. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/tns-2019-04 - http://www.securityfocus.com/bid/108892
CVE ID: CVE-2019-3962 State: PUBLISHED Published: 2019-07-01T19:39:06 Last Updated: 2024-08-04T19:26:27.620Z Vendors: Tenable Products: Nessus Problem Types: Content Injection Description: Content Injection vulnerability in Tenable Nessus prior to 8.5.0 may allow an authenticated, local attacker to exploit this vulnerability by convincing another targeted Nessus user to view a malicious URL and use Nessus to send fraudulent messages. Successful exploitation could allow the authenticated adversary to inject arbitrary text into the feed status, which will remain saved post session expiration. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/tns-
ssion expiration. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/tns-2019-04 - http://www.securityfocus.com/bid/109025
CVE ID: CVE-2019-3963 State: PUBLISHED Published: 2019-08-20T17:55:35 Last Updated: 2024-08-04T19:26:27.479Z Vendors: n/a Products: OpenEMR Problem Types: Cross Site Scripting Description: In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the patient_id parameter. This could allow an attacker to execute arbitrary code in the context of a user's session. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2019-40
CVE ID: CVE-2019-3964 State: PUBLISHED Published: 2019-08-20T17:55:54 Last Updated: 2024-08-04T19:26:27.601Z Vendors: n/a Products: OpenEMR Problem Types: Cross Site Scripting Description: In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the doc_id parameter. This could allow an attacker to execute arbitrary code in the context of a user's session. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2019-40
CVE ID: CVE-2019-3965 State: PUBLISHED Published: 2019-08-20T17:56:03 Last Updated: 2024-08-04T19:26:27.724Z Vendors: n/a Products: OpenEMR Problem Types: Cross Site Scripting Description: In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the document_id parameter. This could allow an attacker to execute arbitrary code in the context of a user's session. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2019-40
CVE ID: CVE-2019-3966 State: PUBLISHED Published: 2019-08-20T17:56:11 Last Updated: 2024-08-04T19:26:27.673Z Vendors: n/a Products: OpenEMR Problem Types: Cross Site Scripting Description: In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the foreign_id parameter. This could allow an attacker to execute arbitrary code in the context of a user's session. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2019-40
CVE ID: CVE-2019-3967 State: PUBLISHED Published: 2019-08-20T17:56:20 Last Updated: 2024-08-04T19:26:27.771Z Vendors: n/a Products: OpenEMR Problem Types: Directory traversal Description: In OpenEMR 5.0.1 and earlier, the patient file download interface contains a directory traversal flaw that allows authenticated attackers to download arbitrary files from the host system. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2019-40
CVE ID: CVE-2019-3968 State: PUBLISHED Published: 2019-08-20T18:01:03 Last Updated: 2024-08-04T19:26:27.637Z Vendors: n/a Products: OpenEMR Problem Types: Command Injection Description: In OpenEMR 5.0.1 and earlier, an authenticated attacker can execute arbitrary commands on the host system via the Scanned Forms interface when creating a new form. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2019-40
CVE ID: CVE-2019-3969 State: PUBLISHED Published: 2019-07-17T20:33:44 Last Updated: 2024-08-04T19:26:27.758Z Vendors: Comodo Products: Comodo Antivirus Problem Types: Improper Privilege Management Description: Comodo Antivirus versions up to 12.0.0.6810 are vulnerable to Local Privilege Escalation due to CmdAgent's handling of COM clients. A local process can bypass the signature check enforced by CmdAgent via process hollowing which can then allow the process to invoke sensitive COM methods in CmdAgent such as writing to the registry with SYSTEM privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2019-34
CVE ID: CVE-2019-3970 State: PUBLISHED Published: 2019-07-17T20:34:21 Last Updated: 2024-08-04T19:26:27.668Z Vendors: n/a Products: Comodo Antivirus Problem Types: Arbitrary File Write Description: Comodo Antivirus versions up to 12.0.0.6810 are vulnerable to Arbitrary File Write due to Cavwp.exe handling of Comodo's Antivirus database. Cavwp.exe loads Comodo antivirus definition database in unsecured global section objects, allowing a local low privileged process to modify this data directly and change virus signatures. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2019-34
CVE ID: CVE-2019-3971 State: PUBLISHED Published: 2019-07-17T20:35:01 Last Updated: 2024-08-04T19:26:27.555Z Vendors: n/a Products: Comodo Antivirus Problem Types: Denial of Service Description: Comodo Antivirus versions up to 12.0.0.6810 are vulnerable to a local Denial of Service affecting CmdVirth.exe via its LPC port "cmdvrtLPCServerPort". A low privileged local process can connect to this port and send an LPC_DATAGRAM, which triggers an Access Violation due to hardcoded NULLs used for Source parameter in a memcpy operation that is called for this handler. This results in CmdVirth.exe and its child svchost.exe instances to terminate. Additional Analyst Notes: - CVE Program Container: Ref
in CmdVirth.exe and its child svchost.exe instances to terminate. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2019-34
CVE ID: CVE-2019-3972 State: PUBLISHED Published: 2019-07-17T20:40:37 Last Updated: 2024-08-04T19:26:27.643Z Vendors: n/a Products: Comodo Antivirus Problem Types: Denial of Service Description: Comodo Antivirus versions 12.0.0.6810 and below are vulnerable to Denial of Service affecting CmdAgent.exe via an unprotected section object "<GUID>_CisSharedMemBuff". This section object is exposed by CmdAgent and contains a SharedMemoryDictionary object, which allows a low privileged process to modify the object data causing CmdAgent.exe to crash. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2019-34
CVE ID: CVE-2019-3973 State: PUBLISHED Published: 2019-07-17T20:41:32 Last Updated: 2024-08-04T19:26:27.704Z Vendors: n/a Products: Comodo Antivirus Problem Types: Denial of Service Description: Comodo Antivirus versions 11.0.0.6582 and below are vulnerable to Denial of Service affecting CmdGuard.sys via its filter port "cmdServicePort". A low privileged process can crash CmdVirth.exe to decrease the port's connection count followed by process hollowing a CmdVirth.exe instance with malicious code to obtain a handle to "cmdServicePort". Once this occurs, a specially crafted message can be sent to "cmdServicePort" using "FilterSendMessage" API. This can trigger an out-of-bounds write if lpOutB
message can be sent to "cmdServicePort" using "FilterSendMessage" API. This can trigger an out-of-bounds write if lpOutBuffer parameter in FilterSendMessage API is near the end of specified buffer bounds. The crash occurs when the driver performs a memset operation which uses a size beyond the size of buffer specified, causing kernel crash. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2019-34
CVE ID: CVE-2019-3974 State: PUBLISHED Published: 2019-08-15T18:58:14 Last Updated: 2024-08-04T19:26:27.647Z Vendors: n/a Products: Tenable Nessus Problem Types: Arbitrary File Overwrite Description: Nessus 8.5.2 and earlier on Windows platforms were found to contain an issue where certain system files could be overwritten arbitrarily, potentially creating a denial of service condition. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/tns-2019-05
CVE ID: CVE-2019-3975 State: PUBLISHED Published: 2019-09-10T15:55:33 Last Updated: 2024-08-04T19:26:27.639Z Vendors: Advantech Products: WebAccess/SCADA Problem Types: Unauthenticated Remote Stack Buffer Overflow Description: Stack-based buffer overflow in Advantech WebAccess/SCADA 8.4.1 allows a remote, unauthenticated attacker to execute arbitrary code via a crafted IOCTL 70603 RPC message. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2019-41
CVE ID: CVE-2019-3976 State: PUBLISHED Published: 2019-10-28T21:32:40 Last Updated: 2024-08-04T19:26:27.527Z Vendors: n/a Products: MikroTik RouterOS Problem Types: CWE-23 Description: RouterOS 6.45.6 Stable, RouterOS 6.44.5 Long-term, and below are vulnerable to an arbitrary directory creation vulnerability via the upgrade package's name field. If an authenticated user installs a malicious package then a directory could be created and the developer shell could be enabled. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2019-46
CVE ID: CVE-2019-3977 State: PUBLISHED Published: 2019-10-28T21:34:37 Last Updated: 2024-08-04T19:26:27.646Z Vendors: n/a Products: MikroTik RouterOS Problem Types: CWE-494 Description: RouterOS 6.45.6 Stable, RouterOS 6.44.5 Long-term, and below insufficiently validate where upgrade packages are download from when using the autoupgrade feature. Therefore, a remote attacker can trick the router into "upgrading" to an older version of RouterOS and possibly reseting all the system's usernames and passwords. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2019-46
CVE ID: CVE-2019-3978 State: PUBLISHED Published: 2019-10-28T21:32:57 Last Updated: 2024-08-04T19:26:27.327Z Vendors: n/a Products: MikroTik RouterOS Problem Types: CWE-306 Description: RouterOS versions 6.45.6 Stable, 6.44.5 Long-term, and below allow remote unauthenticated attackers to trigger DNS queries via port 8291. The queries are sent from the router to a server of the attacker's choice. The DNS responses are cached by the router, potentially resulting in cache poisoning Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2019-46 - http://packetstormsecurity.com/files/155036/MikroTik-RouterOS-6.45.6-DNS-Cache-Poisoning.html
CVE ID: CVE-2019-3979 State: PUBLISHED Published: 2019-10-28T21:33:25 Last Updated: 2024-08-04T19:26:27.785Z Vendors: n/a Products: MikroTik RouterOS Problem Types: Unrelated Data Attack (see: https://www.sans.org/reading-room/whitepapers/dns/security-issues-dns-1069) Description: RouterOS versions 6.45.6 Stable, 6.44.5 Long-term, and below are vulnerable to a DNS unrelated data attack. The router adds all A records to its DNS cache even when the records are unrelated to the domain that was queried. Therefore, a remote attacker controlled DNS server can poison the router's DNS cache via malicious responses with additional and untrue records. Additional Analyst Notes: - CVE Program Container:
DNS cache via malicious responses with additional and untrue records. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2019-46
CVE ID: CVE-2019-3980 State: PUBLISHED Published: 2019-10-08T19:40:07 Last Updated: 2024-08-04T19:26:27.695Z Vendors: n/a Products: SolarWinds Dameware Remote Mini Remote Client Agent Service Problem Types: Unauthenticated Remote Code Execution. Description: The Solarwinds Dameware Mini Remote Client agent v12.1.0.89 supports smart card authentication which can allow a user to upload an executable to be executed on the DWRCS.exe host. An unauthenticated, remote attacker can request smart card login and upload and execute an arbitrary executable run under the Local System account. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-22
count. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-227-43 - https://www.tenable.com/security/research/tra-2019-43
CVE ID: CVE-2019-3981 State: PUBLISHED Published: 2020-01-14T18:13:57 Last Updated: 2024-08-04T19:26:27.758Z Vendors: MikroTik Products: WinBox Problem Types: CWE-300 Description: MikroTik Winbox 3.20 and below is vulnerable to man in the middle attacks. A man in the middle can downgrade the client's authentication protocol and recover the user's username and MD5 hashed password. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2020-01
CVE ID: CVE-2019-3982 State: PUBLISHED Published: 2019-10-23T18:55:07 Last Updated: 2024-08-04T19:26:27.847Z Vendors: n/a Products: Tenable Nessus Problem Types: Denial of Service Description: Nessus versions 8.6.0 and earlier were found to contain a Denial of Service vulnerability due to improper validation of specific imported scan types. An authenticated, remote attacker could potentially exploit this vulnerability to cause a Nessus scanner to become temporarily unresponsive. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/tns-2019-06
CVE ID: CVE-2019-3983 State: PUBLISHED Published: 2019-12-11T22:39:21 Last Updated: 2024-08-04T19:26:27.593Z Vendors: n/a Products: Amazon's Blink XT2 Sync Module Problem Types: Insufficient UART Protections Description: Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary code and commands on the device due to insufficient UART protections. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2019-51
CVE ID: CVE-2019-3984 State: PUBLISHED Published: 2019-12-31T17:45:56 Last Updated: 2024-08-04T19:26:27.744Z Vendors: Amazon Products: Blink XT2 Sync Module firmware Problem Types: Arbitrary Remote Code Execution Description: Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when the device retrieves updates scripts from the internet. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2019-51
CVE ID: CVE-2019-3985 State: PUBLISHED Published: 2019-12-11T22:39:18 Last Updated: 2024-08-04T19:26:27.699Z Vendors: n/a Products: Amazon's Blink XT2 Sync Module Problem Types: Command Injection Description: Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when configuring the devices wifi configuration via the ssid parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2019-51
CVE ID: CVE-2019-3986 State: PUBLISHED Published: 2019-12-11T22:39:13 Last Updated: 2024-08-04T19:26:27.631Z Vendors: n/a Products: Amazon's Blink XT2 Sync Module Problem Types: Command Injection Description: Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when configuring the devices wifi configuration via the encryption parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2019-51
CVE ID: CVE-2019-3987 State: PUBLISHED Published: 2019-12-11T22:39:10 Last Updated: 2024-08-04T19:26:27.466Z Vendors: n/a Products: Amazon's Blink XT2 Sync Module Problem Types: Command Injection Description: Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when configuring the devices wifi configuration via the key parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2019-51
CVE ID: CVE-2019-3988 State: PUBLISHED Published: 2019-12-11T22:39:06 Last Updated: 2024-08-04T19:26:27.554Z Vendors: n/a Products: Amazon's Blink XT2 Sync Module Problem Types: Command Injection Description: Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when configuring the devices wifi configuration via the bssid parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2019-51