Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
955e91%40%3Ccommits.airflow.apache.org%3E - https://lists.apache.org/thread.html/ref70b940c4f69560d29d6ba792d6c82865e74de3dcad4c92d99b1f8f%40%3Ccommits.airflow.apache.org%3E - https://lists.apache.org/thread.html/r853ffeb915a400f899de78124d4e0d77a19379d2e11bf8f4e98c624f%40%3Ccommits.airflow.apache.org%3E - https://lists.apache.org/thread.html/r84b327f7a8b6b28857b906c07a66dd98e1d341191fa8d7816514ef96%40%3Ccommits.airflow.apache.org%3E - https://www.oracle.com/security-alerts/cpujan2022.html - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2019-17496 State: PUBLISHED Published: 2019-10-10T23:32:55 Last Updated: 2024-08-05T01:40:15.780Z Vendors: n/a Products: n/a Problem Types: n/a Description: Craft CMS before 3.3.8 has stored XSS via a name field. This field is mishandled during site deletion. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/craftcms/cms/commit/0ee66d29281af2b6c4f866e1437842c61983a672 - https://github.com/craftcms/cms/blob/develop/CHANGELOG-v3.md#338---2019-10-09
CVE ID: CVE-2019-17497 State: PUBLISHED Published: 2019-10-10T23:52:06 Last Updated: 2024-08-05T01:40:15.799Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tracker PDF-XChange Editor before 8.0.330.0 has an NTLM SSO hash theft vulnerability using crafted FDF or XFDF files (a related issue to CVE-2018-4993). For example, an NTLM hash is sent for a link to \\192.168.0.2\C$\file.pdf without user interaction. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ponypot/cve/raw/master/pdfXChangeEditor_FDFInclusions.pdf
CVE ID: CVE-2019-17498 State: PUBLISHED Published: 2019-10-21T00:00:00 Last Updated: 2024-08-05T01:40:15.913Z Vendors: n/a Products: n/a Problem Types: n/a Description: In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent memory read. A crafted SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/libssh2/libssh2/blob/42d37aa63129a1b2644bf6495198923534322d64/
- CVE Program Container: References: - https://github.com/libssh2/libssh2/blob/42d37aa63129a1b2644bf6495198923534322d64/src/packet.c#L480 - https://blog.semmle.com/libssh2-integer-overflow-CVE-2019-17498/ - https://github.com/kevinbackhouse/SecurityExploits/tree/8cbdbbe6363510f7d9ceec685373da12e6fc752d/libssh2/out_of_bounds_read_disconnect_CVE-2019-17498 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TY7EEE34RFKCTXTMBQQWWSLXZWSCXNDB/ - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00026.html - https://lists.debian.org/debian-lts-announce/2019/11/msg00010.html - https://lists.fedoraproject.org/archives/list/package-announce
ts.debian.org/debian-lts-announce/2019/11/msg00010.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22H4Q5XMGS3QNSA7OCL3U7UQZ4NXMR5O/ - https://github.com/libssh2/libssh2/commit/dedcbd106f8e52d5586b0205bc7677e4c9868f9c - https://lists.debian.org/debian-lts-announce/2021/12/msg00013.html - https://security.netapp.com/advisory/ntap-20220909-0004/ - http://packetstormsecurity.com/files/172835/libssh2-1.9.0-Out-Of-Bounds-Read.html - https://lists.debian.org/debian-lts-announce/2023/09/msg00006.html
CVE ID: CVE-2019-17499 State: PUBLISHED Published: 2019-10-11T10:05:15 Last Updated: 2024-08-05T01:40:15.797Z Vendors: n/a Products: n/a Problem Types: n/a Description: The setter.xml component of the Common Gateway Interface on Compal CH7465LG 6.12.18.25-2p4 devices does not properly validate ping command arguments, which allows remote authenticated users to execute OS commands as root via shell metacharacters in the Target_IP parameter. Additional Analyst Notes: - CVE Program Container: References: - https://gbti.pl/public/10_2019-compal.txt
CVE ID: CVE-2019-17501 State: PUBLISHED Published: 2019-10-14T01:12:09 Last Updated: 2024-08-05T01:40:15.827Z Vendors: n/a Products: n/a Problem Types: n/a Description: Centreon 19.04 allows attackers to execute arbitrary OS commands via the Command Line field of main.php?p=60807&type=4 (aka the Configuration > Commands > Discovery screen). CVE-2019-17501 and CVE-2019-16405 are similar to one another and may be the same. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/sinfulz/ef49270e245df050af59cc3dd3eefa6b
CVE ID: CVE-2019-17502 State: PUBLISHED Published: 2019-10-12T19:53:12 Last Updated: 2024-08-05T01:40:15.782Z Vendors: n/a Products: n/a Problem Types: n/a Description: Hydra through 0.1.8 has a NULL pointer dereference and daemon crash when processing POST requests that lack a Content-Length header. read.c, request.c, and util.c contribute to this. The process_header_end() function calls boa_atoi(), which ultimately calls atoi() on a NULL pointer. Additional Analyst Notes: - CVE Program Container: References: - http://hydra.hellug.gr - https://gist.github.com/fxb6476/0b9883a88ff2ca40de46a8469834e16c
CVE ID: CVE-2019-17503 State: PUBLISHED Published: 2019-10-11T16:21:11 Last Updated: 2024-08-05T01:40:15.757Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Kirona Dynamic Resource Scheduling (DRS) 5.5.3.5. An unauthenticated user can access /osm/REGISTER.cmd (aka /osm_tiles/REGISTER.cmd) directly: it contains sensitive information about the database through the SQL queries within this batch file. This file exposes SQL database information such as database version, table name, column name, etc. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Ramikan/Vulnerabilities/blob/master/Kirona-DRS%205.5.3.5%20Multiple%20Vulnera
ontainer: References: - https://github.com/Ramikan/Vulnerabilities/blob/master/Kirona-DRS%205.5.3.5%20Multiple%20Vulnerabilities - http://packetstormsecurity.com/files/154838/Kirona-DRS-5.5.3.5-Information-Disclosure.html
CVE ID: CVE-2019-17504 State: PUBLISHED Published: 2019-10-11T16:21:01 Last Updated: 2024-08-05T01:40:15.907Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Kirona Dynamic Resource Scheduling (DRS) 5.5.3.5. A reflected Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script via the /osm/report/ password parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Ramikan/Vulnerabilities/blob/master/Kirona-DRS%205.5.3.5%20Multiple%20Vulnerabilities - http://packetstormsecurity.com/files/154838/Kirona-DRS-5.5.3.5-Information-Disclosure.html
CVE ID: CVE-2019-17505 State: PUBLISHED Published: 2019-10-11T19:28:39 Last Updated: 2024-08-05T01:40:15.914Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DAP-1320 A2-V1.21 routers have some web interfaces without authentication requirements, as demonstrated by uplink_info.xml. An attacker can remotely obtain a user's Wi-Fi SSID and password, which could be used to connect to Wi-Fi or perform a dictionary attack. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dahua966/Routers-vuls/blob/master/DAP-1320/vuls_poc.md
CVE ID: CVE-2019-17506 State: PUBLISHED Published: 2019-10-11T19:29:43 Last Updated: 2024-08-05T01:40:15.762Z Vendors: n/a Products: n/a Problem Types: n/a Description: There are some web interfaces without authentication requirements on D-Link DIR-868L B1-2.03 and DIR-817LW A1-1.04 routers. An attacker can get the router's username and password (and other information) via a DEVICE.ACCOUNT value for SERVICES in conjunction with AUTHORIZED_GROUP=1%0a to getcfg.php. This could be used to control the router remotely. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dahua966/Routers-vuls/blob/master/DIR-868/name%26passwd.py
CVE ID: CVE-2019-17507 State: PUBLISHED Published: 2019-10-11T19:29:32 Last Updated: 2024-08-05T01:40:16.158Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DIR-816 A1 1.06 devices. An attacker could access management pages of the router via a client that ignores the 'top.location.href = "/dir_login.asp"' line in a .asp file. This provides access to d_status.asp, version.asp, d_dhcptbl.asp, and d_acl.asp. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dahua966/Routers-vuls/tree/master/DIR-816
CVE ID: CVE-2019-17508 State: PUBLISHED Published: 2019-10-11T19:29:17 Last Updated: 2024-08-05T01:40:15.787Z Vendors: n/a Products: n/a Problem Types: n/a Description: On D-Link DIR-859 A3-1.06 and DIR-850 A1.13 devices, /etc/services/DEVICE.TIME.php allows command injection via the $SERVER variable. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dahua966/Routers-vuls/tree/master/DIR-859
CVE ID: CVE-2019-17509 State: PUBLISHED Published: 2019-10-11T19:29:04 Last Updated: 2024-08-05T01:40:15.791Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-846 devices with firmware 100A35 allow remote attackers to execute arbitrary OS commands as root by leveraging admin access and sending a /HNAP1/ request for SetMasterWLanSettings with shell metacharacters to /squashfs-root/www/HNAP1/control/SetMasterWLanSettings.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dahua966/Routers-vuls/blob/master/DIR-846/vuls_info.md
CVE ID: CVE-2019-17510 State: PUBLISHED Published: 2019-10-11T19:28:54 Last Updated: 2024-08-05T01:40:15.912Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-846 devices with firmware 100A35 allow remote attackers to execute arbitrary OS commands as root by leveraging admin access and sending a /HNAP1/ request for SetWizardConfig with shell metacharacters to /squashfs-root/www/HNAP1/control/SetWizardConfig.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dahua966/Routers-vuls/blob/master/DIR-846/vuls_info.md
CVE ID: CVE-2019-17511 State: PUBLISHED Published: 2019-10-14T15:01:29 Last Updated: 2024-08-05T01:40:15.859Z Vendors: n/a Products: n/a Problem Types: n/a Description: There are some web interfaces without authentication requirements on D-Link DIR-412 A1-1.14WW routers. An attacker can get the router's log file via log_get.php, which could be used to discover the intranet network structure. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dahua966/Routers-vuls - https://github.com/dahua966/Routers-vuls/blob/master/DIR-412/vuls_info.md
CVE ID: CVE-2019-17512 State: PUBLISHED Published: 2019-10-16T18:32:41 Last Updated: 2024-08-05T01:40:15.842Z Vendors: n/a Products: n/a Problem Types: n/a Description: There are some web interfaces without authentication requirements on D-Link DIR-412 A1-1.14WW routers. An attacker can clear the router's log file via act=clear&logtype=sysact to log_clear.php, which could be used to erase attack traces. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dahua966/Routers-vuls - https://github.com/dahua966/Routers-vuls/blob/master/DIR-412/vuls_info.md
CVE ID: CVE-2019-17513 State: PUBLISHED Published: 2019-10-18T02:36:25 Last Updated: 2024-08-05T01:40:15.853Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Ratpack before 1.7.5. Due to a misuse of the Netty library class DefaultHttpHeaders, there is no validation that headers lack HTTP control characters. Thus, if untrusted data is used to construct HTTP headers with Ratpack, HTTP Response Splitting can occur. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ratpack/ratpack/commit/efb910d38a96494256f36675ef0e5061097dd77d - https://github.com/ratpack/ratpack/commit/c560a8d10cb8bdd7a526c1ca2e67c8f224ca23ae - https://rat
36675ef0e5061097dd77d - https://github.com/ratpack/ratpack/commit/c560a8d10cb8bdd7a526c1ca2e67c8f224ca23ae - https://ratpack.io/versions/1.7.5 - https://github.com/ratpack/ratpack/security/advisories/GHSA-mvqp-q37c-wf9j - https://github.com/ratpack/ratpack/releases/tag/v1.7.5
CVE ID: CVE-2019-17514 State: PUBLISHED Published: 2019-10-12T12:07:23 Last Updated: 2024-08-05T01:40:15.920Z Vendors: n/a Products: n/a Problem Types: n/a Description: library/glob.html in the Python 2 and 3 documentation before 2016 has potentially misleading information about whether sorting occurs, as demonstrated by irreproducible cancer-research results. NOTE: the effects of this documentation cross application domains, and thus it is likely that security-relevant code elsewhere is affected. This issue is not a Python implementation bug, and there are no reports that NMR researchers were specifically relying on library/glob.html. In other words, because the older documentation stated "
NMR researchers were specifically relying on library/glob.html. In other words, because the older documentation stated "finds all the pathnames matching a specified pattern according to the rules used by the Unix shell," one might have incorrectly inferred that the sorting that occurs in a Unix shell also occurred for glob.glob. There is a workaround in newer versions of Willoughby nmr-data_compilation-p2.py and nmr-data_compilation-p3.py, which call sort() directly. Additional Analyst Notes: - CVE Program Container: References: - https://web.archive.org/web/20150906020027/https://docs.python.org/2.7/library/glob.html - https://web.archive.org/web/20160526201356/https://docs.python.org/2.7/l
https://docs.python.org/2.7/library/glob.html - https://web.archive.org/web/20160526201356/https://docs.python.org/2.7/library/glob.html - https://web.archive.org/web/20150822013622/https://docs.python.org/3/library/glob.html - https://web.archive.org/web/20160309211341/https://docs.python.org/3/library/glob.html - https://github.com/bminor/bash/blob/ac50fbac377e32b98d2de396f016ea81e8ee9961/pathexp.c#L380 - https://github.com/bminor/bash/blob/ac50fbac377e32b98d2de396f016ea81e8ee9961/pathexp.c#L405 - https://bugs.python.org/issue33275 - https://twitter.com/LucasCMoore/status/1181615421922824192 - https://pubs.acs.org/doi/suppl/10.1021/acs.orglett.9b03216/suppl_file/ol9b03216_si_002.zip - http
/1181615421922824192 - https://pubs.acs.org/doi/suppl/10.1021/acs.orglett.9b03216/suppl_file/ol9b03216_si_002.zip - https://pubs.acs.org/doi/full/10.1021/acs.orglett.9b03216 - https://www.vice.com/en_us/article/zmjwda/a-code-glitch-may-have-caused-errors-in-more-than-100-published-studies - https://twitter.com/chris_bloke/status/1181997278136958976 - https://security.netapp.com/advisory/ntap-20191107-0005/ - https://usn.ubuntu.com/4428-1/
CVE ID: CVE-2019-17515 State: PUBLISHED Published: 2019-11-13T20:08:30 Last Updated: 2024-08-05T01:40:15.834Z Vendors: n/a Products: n/a Problem Types: n/a Description: The CleanTalk cleantalk-spam-protect plugin before 5.127.4 for WordPress is affected by: Cross Site Scripting (XSS). The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via the from or till parameter. The component is: inc/cleantalk-users.php and inc/cleantalk-comments.php. The attack vector is: When the Administrator is logged in, a reflected XSS may execute upon a click on a malicious URL. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/cleantalk-spa
icious URL. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/cleantalk-spam-protect/#developers - https://plugins.trac.wordpress.org/changeset/2172333 - https://wpvulndb.com/vulnerabilities/9949
CVE ID: CVE-2019-17517 State: PUBLISHED Published: 2020-02-10T20:18:55 Last Updated: 2024-08-05T01:40:15.755Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Bluetooth Low Energy implementation on Dialog Semiconductor SDK through 5.0.4 for DA14580/1/2/3 devices does not properly restrict the L2CAP payload length, allowing attackers in radio range to cause a buffer overflow via a crafted Link Layer packet. Additional Analyst Notes: - CVE Program Container: References: - https://www.dialog-semiconductor.com/products/connectivity/bluetooth-low-energy/smartbond-da14580-and-da14583 - https://asset-group.github.io/disclosures/sweyntooth/
CVE ID: CVE-2019-17518 State: PUBLISHED Published: 2020-02-10T20:22:14 Last Updated: 2024-08-05T01:40:15.780Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Bluetooth Low Energy implementation on Dialog Semiconductor SDK through 1.0.14.1081 for DA1468x devices responds to link layer packets with a payload length larger than expected, allowing attackers in radio range to cause a buffer overflow via a crafted packet. This affects, for example, August Smart Lock. Additional Analyst Notes: - CVE Program Container: References: - https://www.dialog-semiconductor.com/ja/products/connectivity/bluetooth-low-energy/smartbond-da14680-and-da14681 - https://asset-group.github.io/disclosur
om/ja/products/connectivity/bluetooth-low-energy/smartbond-da14680-and-da14681 - https://asset-group.github.io/disclosures/sweyntooth/
CVE ID: CVE-2019-17519 State: PUBLISHED Published: 2020-02-12T18:04:08 Last Updated: 2024-08-05T01:40:15.913Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Bluetooth Low Energy implementation on NXP SDK through 2.2.1 for KW41Z devices does not properly restrict the Link Layer payload length, allowing attackers in radio range to cause a buffer overflow via a crafted packet. Additional Analyst Notes: - CVE Program Container: References: - https://asset-group.github.io/disclosures/sweyntooth/
CVE ID: CVE-2019-17520 State: PUBLISHED Published: 2020-02-10T20:26:43 Last Updated: 2024-08-05T01:40:15.815Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Bluetooth Low Energy implementation on Texas Instruments SDK through 3.30.00.20 for CC2640R2 devices does not properly restrict the SM Public Key packet on reception, allowing attackers in radio range to cause a denial of service (crash) via crafted packets. Additional Analyst Notes: - CVE Program Container: References: - http://www.ti.com/tool/LAUNCHXL-CC2640R2 - https://asset-group.github.io/disclosures/sweyntooth/ - https://www.youtube.com/watch?v=Iw8sIBLWE_w
CVE ID: CVE-2019-17521 State: PUBLISHED Published: 2019-10-12T17:44:22 Last Updated: 2024-08-05T01:40:15.803Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Landing-CMS 0.0.6. There is a CSRF vulnerability that can change the admin's password via the password/ URI, Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Elias-Black/Landing-CMS/issues/8
CVE ID: CVE-2019-17522 State: PUBLISHED Published: 2019-10-12T17:44:10 Last Updated: 2024-08-05T01:40:15.961Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored XSS vulnerability was discovered in Hotaru CMS v1.7.2 via the admin_index.php?page=settings SITE NAME field (aka SITE_NAME), a related issue to CVE-2011-4709.1. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/HotaruCMS/HotaruCMS/issues/101 - https://github.com/HotaruCMS/HotaruCMS/blob/1a58334da94511df723bfbe78bba77765df181b1/install/libs/install_tables.php#L383
CVE ID: CVE-2019-17523 State: PUBLISHED Published: 2019-11-13T14:37:36 Last Updated: 2024-08-05T01:40:15.827Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XSS vulnerability on Technicolor TC7300 STFA.51.20 devices allows remote attackers to inject arbitrary web script via the FileName parameter to /FTPDiag.asp. Additional Analyst Notes: - CVE Program Container: References: - https://www.technicolor.com/news - https://gitlab.com/luiss/cve_repo/blob/master/CVE-2019-17524/README.md
CVE ID: CVE-2019-17524 State: PUBLISHED Published: 2019-11-13T14:36:01 Last Updated: 2024-08-05T01:40:15.971Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XSS vulnerability on Technicolor TC7300 STFA.51.20 devices allows remote attackers to inject arbitrary web script via the "Connected Clients" field to /wlanAccess.asp. An intranet host can use a crafted hostname to exploit this. Additional Analyst Notes: - CVE Program Container: References: - https://www.technicolor.com/news - https://gitlab.com/luiss/cve_repo/blob/master/CVE-2019-17523/README.md
CVE ID: CVE-2019-17525 State: PUBLISHED Published: 2020-04-21T18:57:50 Last Updated: 2024-08-05T01:40:15.975Z Vendors: n/a Products: n/a Problem Types: n/a Description: The login page on D-Link DIR-615 T1 20.10 devices allows remote attackers to bypass the CAPTCHA protection mechanism and conduct brute-force attacks. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/huzaifahussain98/CVE-2019-17525/ - http://packetstormsecurity.com/files/157936/D-Link-DIR-615-T1-20.10-CAPTCHA-Bypass.html
CVE ID: CVE-2019-17526 State: PUBLISHED Published: 2019-10-18T16:15:08 Last Updated: 2024-08-05T01:40:15.933Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in SageMath Sage Cell Server through 2019-10-05. Python Code Injection can occur in the context of an internet facing web application. Malicious actors can execute arbitrary commands on the underlying operating system, as demonstrated by an __import__('os').popen('whoami').read() line. NOTE: the vendor's position is that the product is "vulnerable by design" and the current behavior will be retained Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sagemath/sagecell/co
ill be retained Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sagemath/sagecell/commits/master - https://sethsec.blogspot.com/2016/11/exploiting-python-code-injection-in-web.html - https://gist.github.com/barrett092/0380a1c34c014e29b827d1f408381525
CVE ID: CVE-2019-17527 State: PUBLISHED Published: 2019-12-19T20:41:07 Last Updated: 2024-08-05T01:40:15.804Z Vendors: n/a Products: n/a Problem Types: n/a Description: dataForDepandantField in models/custormfields.php in the JS JOBS FREE extension before 1.2.7 for Joomla! allows SQL Injection via the index.php?option=com_jsjobs&task=customfields.getfieldtitlebyfieldandfieldfo child parameter. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/blackcon/c61771eb8c9f0aeef6f6797f945efa13
CVE ID: CVE-2019-17528 State: PUBLISHED Published: 2019-10-12T19:21:49 Last Updated: 2024-08-05T01:40:15.804Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Bento4 1.5.1.0. There is a SEGV in the function AP4_TfhdAtom::SetDefaultSampleSize at Core/Ap4TfhdAtom.h when called from AP4_Processor::ProcessFragments in Core/Ap4Processor.cpp. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/axiomatic-systems/Bento4/issues/432 - https://github.com/TeamSeri0us/pocs/tree/master/bento4
CVE ID: CVE-2019-17529 State: PUBLISHED Published: 2019-10-12T19:21:41 Last Updated: 2024-08-05T01:40:15.809Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Bento4 1.5.1.0. There is a heap-based buffer over-read in AP4_CencSampleEncryption::DoInspectFields in Core/Ap4CommonEncryption.cpp when called from AP4_Atom::Inspect in Core/Ap4Atom.cpp. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TeamSeri0us/pocs/tree/master/bento4 - https://github.com/axiomatic-systems/Bento4/issues/430
CVE ID: CVE-2019-17530 State: PUBLISHED Published: 2019-10-12T19:21:29 Last Updated: 2024-08-05T01:40:15.828Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Bento4 1.5.1.0. There is a heap-based buffer over-read in AP4_PrintInspector::AddField in Core/Ap4Atom.cpp when called from AP4_CencSampleEncryption::DoInspectFields in Core/Ap4CommonEncryption.cpp, when called from AP4_Atom::Inspect in Core/Ap4Atom.cpp. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TeamSeri0us/pocs/tree/master/bento4 - https://github.com/axiomatic-systems/Bento4/issues/431