Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-16540 State: PUBLISHED Published: 2019-11-21T14:11:20 Last Updated: 2024-08-05T01:17:40.283Z Vendors: Jenkins project Products: Jenkins Support Core Plugin Description: A path traversal vulnerability in Jenkins Support Core Plugin 2.63 and earlier allows attackers with Overall/Read permission to delete arbitrary files on the Jenkins master. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-11-21/#SECURITY-1634 - http://www.openwall.com/lists/oss-security/2019/11/21/1
CVE ID: CVE-2019-16541 State: PUBLISHED Published: 2019-11-21T14:11:21 Last Updated: 2024-08-05T01:17:40.816Z Vendors: Jenkins project Products: Jenkins JIRA Plugin Description: Jenkins JIRA Plugin 3.0.10 and earlier does not declare the correct (folder) scope for per-folder Jira site definitions, allowing users to select and use credentials with System scope. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-11-21/#SECURITY-1106 - http://www.openwall.com/lists/oss-security/2019/11/21/1
CVE ID: CVE-2019-16542 State: PUBLISHED Published: 2019-11-21T14:11:21 Last Updated: 2024-08-05T01:17:40.255Z Vendors: Jenkins project Products: Jenkins Anchore Container Image Scanner Plugin Description: Jenkins Anchore Container Image Scanner Plugin 1.0.19 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-11-21/#SECURITY-1539 - http://www.openwall.com/lists/oss-security/2019/11/21/1
CVE ID: CVE-2019-16543 State: PUBLISHED Published: 2019-11-21T14:11:22 Last Updated: 2024-08-05T01:17:40.220Z Vendors: Jenkins project Products: Jenkins Spira Importer Plugin Description: Jenkins Spira Importer Plugin 3.2.2 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-11-21/#SECURITY-1554 - http://www.openwall.com/lists/oss-security/2019/11/21/1
CVE ID: CVE-2019-16544 State: PUBLISHED Published: 2019-11-21T14:11:22 Last Updated: 2024-08-05T01:17:40.979Z Vendors: Jenkins project Products: Jenkins QMetry for JIRA - Test Management Plugin Description: Jenkins QMetry for JIRA - Test Management Plugin 1.12 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-11-21/#SECURITY-727%20%281%29 - http://www.openwall.com/lists/oss-security/2019/11/21/1
CVE ID: CVE-2019-16545 State: PUBLISHED Published: 2019-11-21T14:11:23 Last Updated: 2024-08-05T01:17:40.302Z Vendors: Jenkins project Products: Jenkins QMetry for JIRA - Test Management Plugin Description: Jenkins QMetry for JIRA - Test Management Plugin transmits credentials in its configuration in plain text as part of job configuration forms, potentially resulting in their exposure. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-11-21/#SECURITY-727%20%282%29 - http://www.openwall.com/lists/oss-security/2019/11/21/1
CVE ID: CVE-2019-16546 State: PUBLISHED Published: 2019-11-21T14:11:23 Last Updated: 2024-08-05T01:17:40.240Z Vendors: Jenkins project Products: Jenkins Google Compute Engine Plugin Description: Jenkins Google Compute Engine Plugin 4.1.1 and earlier does not verify SSH host keys when connecting agents created by the plugin, enabling man-in-the-middle attacks. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-11-21/#SECURITY-1584 - http://www.openwall.com/lists/oss-security/2019/11/21/1
CVE ID: CVE-2019-16547 State: PUBLISHED Published: 2019-11-21T14:11:23 Last Updated: 2024-08-05T01:17:40.265Z Vendors: Jenkins project Products: Jenkins Google Compute Engine Plugin Description: Missing permission checks in various API endpoints in Jenkins Google Compute Engine Plugin 4.1.1 and earlier allow attackers with Overall/Read permission to obtain limited information about the plugin configuration and environment. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-11-21/#SECURITY-1585 - http://www.openwall.com/lists/oss-security/2019/11/21/1
CVE ID: CVE-2019-16548 State: PUBLISHED Published: 2019-11-21T14:11:24 Last Updated: 2024-08-05T01:17:40.791Z Vendors: Jenkins project Products: Jenkins Google Compute Engine Plugin Description: A cross-site request forgery vulnerability in Jenkins Google Compute Engine Plugin 4.1.1 and earlier in ComputeEngineCloud#doProvision could be used to provision new agents. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-11-21/#SECURITY-1586 - http://www.openwall.com/lists/oss-security/2019/11/21/1
CVE ID: CVE-2019-16549 State: PUBLISHED Published: 2019-12-17T14:40:45 Last Updated: 2024-08-05T01:17:40.903Z Vendors: Jenkins project Products: Jenkins Maven Release Plugin Description: Jenkins Maven Release Plugin 0.16.1 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks, allowing man-in-the-middle attackers to have Jenkins parse crafted XML documents. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1681 - http://www.openwall.com/lists/oss-security/2019/12/17/1
CVE ID: CVE-2019-16550 State: PUBLISHED Published: 2019-12-17T14:40:45 Last Updated: 2024-08-05T01:17:40.818Z Vendors: Jenkins project Products: Jenkins Maven Release Plugin Description: A cross-site request forgery vulnerability in a connection test form method in Jenkins Maven Release Plugin 0.16.1 and earlier allows attackers to have Jenkins connect to an attacker specified web server and parse XML documents. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1681 - http://www.openwall.com/lists/oss-security/2019/12/17/1
CVE ID: CVE-2019-16551 State: PUBLISHED Published: 2019-12-17T14:40:45 Last Updated: 2024-08-05T01:17:40.778Z Vendors: Jenkins project Products: Jenkins Gerrit Trigger Plugin Description: A cross-site request forgery vulnerability in Jenkins Gerrit Trigger Plugin 2.30.1 and earlier allows attackers to connect to an attacker-specified HTTP URL or SSH server using attacker-specified credentials. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1527 - http://www.openwall.com/lists/oss-security/2019/12/17/1
CVE ID: CVE-2019-16552 State: PUBLISHED Published: 2019-12-17T14:40:46 Last Updated: 2024-08-05T01:17:40.885Z Vendors: Jenkins project Products: Jenkins Gerrit Trigger Plugin Description: A missing permission check in Jenkins Gerrit Trigger Plugin 2.30.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP URL or SSH server using attacker-specified credentials, or determine the existence of a file with a given path on the Jenkins master. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1527 - http://www.openwall.com/lists/oss-security/2019/12/17/1
CVE ID: CVE-2019-16553 State: PUBLISHED Published: 2019-12-17T14:40:46 Last Updated: 2024-08-05T01:17:40.794Z Vendors: Jenkins project Products: Jenkins Build Failure Analyzer Plugin Description: A cross-site request forgery vulnerability in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier allows attackers to have Jenkins evaluate a computationally expensive regular expression. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1651 - http://www.openwall.com/lists/oss-security/2019/12/17/1
CVE ID: CVE-2019-16554 State: PUBLISHED Published: 2019-12-17T14:40:47 Last Updated: 2024-08-05T01:17:40.801Z Vendors: Jenkins project Products: Jenkins Build Failure Analyzer Plugin Description: A missing permission check in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier allows attackers with Overall/Read permission to have Jenkins evaluate a computationally expensive regular expression. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1651 - http://www.openwall.com/lists/oss-security/2019/12/17/1
CVE ID: CVE-2019-16555 State: PUBLISHED Published: 2019-12-17T14:40:47 Last Updated: 2024-08-05T01:17:41.026Z Vendors: Jenkins project Products: Jenkins Build Failure Analyzer Plugin Description: A user-supplied regular expression in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier was processed in a way that wasn't interruptible, allowing attackers to have Jenkins evaluate a regular expression without the ability to interrupt this process. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1651 - http://www.openwall.com/lists/oss-security/2019/12/17/1
CVE ID: CVE-2019-16556 State: PUBLISHED Published: 2019-12-17T14:40:48 Last Updated: 2024-08-05T01:17:41.007Z Vendors: Jenkins project Products: Jenkins Rundeck Plugin Description: Jenkins Rundeck Plugin 3.6.5 and earlier stores credentials unencrypted in its global configuration file and in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1636 - http://www.openwall.com/lists/oss-security/2019/12/17/1
CVE ID: CVE-2019-16557 State: PUBLISHED Published: 2019-12-17T14:40:48 Last Updated: 2024-08-05T01:17:40.840Z Vendors: Jenkins project Products: Jenkins Redgate SQL Change Automation Plugin Description: Jenkins Redgate SQL Change Automation Plugin 2.0.3 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1598 - http://www.openwall.com/lists/oss-security/2019/12/17/1
CVE ID: CVE-2019-16558 State: PUBLISHED Published: 2019-12-17T14:40:49 Last Updated: 2024-08-05T01:17:41.027Z Vendors: Jenkins project Products: Jenkins Spira Importer Plugin Description: Jenkins Spira Importer Plugin 3.2.3 and earlier disables SSL/TLS certificate validation for the Jenkins master JVM. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1580 - http://www.openwall.com/lists/oss-security/2019/12/17/1
CVE ID: CVE-2019-16559 State: PUBLISHED Published: 2019-12-17T14:40:49 Last Updated: 2024-08-05T01:17:40.812Z Vendors: Jenkins project Products: Jenkins WebSphere Deployer Plugin Description: A missing permission check in Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows attackers with Overall/Read permission to perform connection tests and determine whether files with an attacker-specified path exist on the Jenkins master file system. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1371 - http://www.openwall.com/lists/oss-security/2019/12/17/1
CVE ID: CVE-2019-16560 State: PUBLISHED Published: 2019-12-17T14:40:50 Last Updated: 2024-08-05T01:17:41.041Z Vendors: Jenkins project Products: Jenkins WebSphere Deployer Plugin Description: A cross-site request forgery vulnerability in Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows attackers to perform connection tests and determine whether files with an attacker-specified path exist on the Jenkins master file system. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1371 - http://www.openwall.com/lists/oss-security/2019/12/17/1
CVE ID: CVE-2019-16561 State: PUBLISHED Published: 2019-12-17T14:40:50 Last Updated: 2024-08-05T01:17:41.047Z Vendors: Jenkins project Products: Jenkins WebSphere Deployer Plugin Description: Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows users with Overall/Read access to disable SSL/TLS certificate and hostname validation for the entire Jenkins master JVM. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1581 - http://www.openwall.com/lists/oss-security/2019/12/17/1
CVE ID: CVE-2019-16562 State: PUBLISHED Published: 2019-12-17T14:40:50 Last Updated: 2024-08-05T01:17:41.027Z Vendors: Jenkins project Products: Jenkins buildgraph-view Plugin Description: Jenkins buildgraph-view Plugin 1.8 and earlier does not escape the description of builds shown in its view, resulting in a stored XSS vulnerability exploitable by users able to change build descriptions. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1591 - http://www.openwall.com/lists/oss-security/2019/12/17/1
CVE ID: CVE-2019-16563 State: PUBLISHED Published: 2019-12-17T14:40:51 Last Updated: 2024-08-05T01:17:40.824Z Vendors: Jenkins project Products: Jenkins Mission Control Plugin Description: Jenkins Mission Control Plugin 0.9.16 and earlier does not escape job display names and build names shown on its view, resulting in a stored XSS vulnerability exploitable by attackers able to change these properties. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1592 - http://www.openwall.com/lists/oss-security/2019/12/17/1
CVE ID: CVE-2019-16564 State: PUBLISHED Published: 2019-12-17T14:40:51 Last Updated: 2024-08-05T01:17:41.024Z Vendors: Jenkins project Products: Jenkins Pipeline Aggregator View Plugin Description: Jenkins Pipeline Aggregator View Plugin 1.8 and earlier does not escape information shown on its view, resulting in a stored XSS vulnerability exploitable by attackers able to affects view content such as job display name or pipeline stage names. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1593 - http://www.openwall.com/lists/oss-security/2019/12/17/1
CVE ID: CVE-2019-16565 State: PUBLISHED Published: 2019-12-17T14:40:52 Last Updated: 2024-08-05T01:17:41.026Z Vendors: Jenkins project Products: Jenkins Team Concert Plugin Description: A cross-site request forgery vulnerability in Jenkins Team Concert Plugin 1.3.0 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1605%20%281%29 - http://www.openwall.com/lists/oss-security/2019/12/17/1
CVE ID: CVE-2019-16566 State: PUBLISHED Published: 2019-12-17T14:40:52 Last Updated: 2024-08-05T01:17:41.065Z Vendors: Jenkins project Products: Jenkins Team Concert Plugin Description: A missing permission check in Jenkins Team Concert Plugin 1.3.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1605%20%281%29 - http://www.openwall.com/lists/oss-security/2019/12/17/1
CVE ID: CVE-2019-16567 State: PUBLISHED Published: 2019-12-17T14:40:53 Last Updated: 2024-08-05T01:17:41.030Z Vendors: Jenkins project Products: Jenkins Team Concert Plugin Description: A missing permission check in Jenkins Team Concert Plugin 1.3.0 and earlier in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1605%20%282%29 - http://www.openwall.com/lists/oss-security/2019/12/17/1
CVE ID: CVE-2019-16568 State: PUBLISHED Published: 2019-12-17T14:40:53 Last Updated: 2024-08-05T01:17:40.841Z Vendors: Jenkins project Products: Jenkins SCTMExecutor Plugin Description: Jenkins SCTMExecutor Plugin 2.2 and earlier transmits previously configured service credentials in plain text as part of the global configuration, as well as individual jobs' configurations. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1521 - http://www.openwall.com/lists/oss-security/2019/12/17/1
CVE ID: CVE-2019-16569 State: PUBLISHED Published: 2019-12-17T14:40:54 Last Updated: 2024-08-05T01:17:40.898Z Vendors: Jenkins project Products: Jenkins Mantis Plugin Description: A cross-site request forgery vulnerability in Jenkins Mantis Plugin 0.26 and earlier allows attackers to connect to an attacker-specified web server using attacker-specified credentials. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1603 - http://www.openwall.com/lists/oss-security/2019/12/17/1
CVE ID: CVE-2019-16570 State: PUBLISHED Published: 2019-12-17T14:40:54 Last Updated: 2024-08-05T01:17:40.997Z Vendors: Jenkins project Products: Jenkins RapidDeploy Plugin Description: A cross-site request forgery vulnerability in Jenkins RapidDeploy Plugin 4.1 and earlier allows attackers to connect to an attacker-specified web server. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1604 - http://www.openwall.com/lists/oss-security/2019/12/17/1
CVE ID: CVE-2019-16571 State: PUBLISHED Published: 2019-12-17T14:40:55 Last Updated: 2024-08-05T01:17:41.021Z Vendors: Jenkins project Products: Jenkins RapidDeploy Plugin Description: A missing permission check in Jenkins RapidDeploy Plugin 4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified web server. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1604 - http://www.openwall.com/lists/oss-security/2019/12/17/1
CVE ID: CVE-2019-16572 State: PUBLISHED Published: 2019-12-17T14:40:55 Last Updated: 2024-08-09T19:44:03.137Z Vendors: Jenkins project Products: Jenkins Weibo Plugin Description: Jenkins Weibo Plugin 1.0.1 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Jenkins Weibo Plugin 1.0.1 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system. References: - https://jenkins.io/security/advisor
ere they can be viewed by users with access to the master file system. References: - https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1597 - http://www.openwall.com/lists/oss-security/2019/12/17/1
CVE ID: CVE-2019-16573 State: PUBLISHED Published: 2019-12-17T14:40:55 Last Updated: 2024-08-05T01:17:41.037Z Vendors: Jenkins project Products: Jenkins Alauda DevOps Pipeline Plugin Description: A cross-site request forgery vulnerability in Jenkins Alauda DevOps Pipeline Plugin 2.3.2 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1600 - http://www.openwall.com/lists/oss-security/2019/12/17/1
CVE ID: CVE-2019-16574 State: PUBLISHED Published: 2019-12-17T14:40:56 Last Updated: 2024-08-05T01:17:40.996Z Vendors: Jenkins project Products: Jenkins Alauda DevOps Pipeline Plugin Description: A missing permission check in Jenkins Alauda DevOps Pipeline Plugin 2.3.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1600 - http://www.openwall.com/lists/oss-security/2019/12/17/1
CVE ID: CVE-2019-16575 State: PUBLISHED Published: 2019-12-17T14:40:56 Last Updated: 2024-08-05T01:17:40.906Z Vendors: Jenkins project Products: Jenkins Alauda Kubernetes Suport Plugin Description: A cross-site request forgery vulnerability in Jenkins Alauda Kubernetes Suport Plugin 2.3.0 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing the Kubernetes service account token or credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1602 - http://www.openwall.com/lists/oss-security/2019/12/17/1
CVE ID: CVE-2019-16576 State: PUBLISHED Published: 2019-12-17T14:40:57 Last Updated: 2024-08-05T01:17:41.023Z Vendors: Jenkins project Products: Jenkins Alauda Kubernetes Suport Plugin Description: A missing permission check in Jenkins Alauda Kubernetes Suport Plugin 2.3.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing the Kubernetes service account token or credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1602 - http://www.openwall.com/lists/oss-security/
ferences: - https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1602 - http://www.openwall.com/lists/oss-security/2019/12/17/1
CVE ID: CVE-2019-16638 State: PUBLISHED Published: 2024-07-16T00:00:00.000Z Last Updated: 2025-03-18T19:59:08.380Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was found on the Ruijie EG-2000 series gateway. An attacker can easily dump cleartext stored passwords in /data/config.text with simple XORs. This affects EG-2000SE EG_RGOS 11.1(1)B1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://0x.mk/?p=239
CVE ID: CVE-2019-16639 State: PUBLISHED Published: 2024-07-16T00:00:00 Last Updated: 2024-08-05T01:17:40.991Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was found on the Ruijie EG-2000 series gateway. There is a newcli.php API interface without access control, which can allow an attacker (who only has web interface access) to use TELNET commands and/or show admin passwords via the mode_url=exec&command= substring. This affects EG-2000SE EG_RGOS 11.9 B11P1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://0x.mk/?p=239
CVE ID: CVE-2019-16640 State: PUBLISHED Published: 2024-07-16T00:00:00 Last Updated: 2024-08-05T01:17:40.886Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was found in upload.php on the Ruijie EG-2000 series gateway. A parameter passed to the class UploadFile is mishandled (%00 and /var/./html are not checked), which can allow an attacker to upload any file to the gateway. This affects EG-2000SE EG_RGOS 11.9 B11P1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://0x.mk/?p=239