Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-6242 State: PUBLISHED Published: 2019-02-08T05:00:00 Last Updated: 2024-08-04T20:16:24.785Z Vendors: n/a Products: n/a Problem Types: n/a Description: Kentico v10.0.42 allows Global Administrators to read the cleartext SMTP Password by navigating to the SMTP configuration page. NOTE: the vendor considers this a best-practice violation but not a vulnerability. The vendor plans to fix it at a future time Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/boatpavaris/cff51e52a96fdde8215f71a3315703c2
CVE ID: CVE-2019-6243 State: PUBLISHED Published: 2019-01-12T02:00:00 Last Updated: 2024-08-04T20:16:24.650Z Vendors: n/a Products: n/a Problem Types: n/a Description: Frog CMS 0.9.5 allows XSS via the forgot password page (aka the /admin/?/login/forgot URI). Additional Analyst Notes: - CVE Program Container: References: - https://somerandomshitwbu.blogspot.com/2019/01/another-xss-on-frog-cms-open-source.html
CVE ID: CVE-2019-6244 State: PUBLISHED Published: 2019-01-12T02:00:00 Last Updated: 2024-08-04T20:16:24.789Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in UsualToolCMS 8.0. cmsadmin/a_sqlbackx.php?t=sql allows CSRF attacks that can execute SQL statements, and consequently execute arbitrary PHP code by writing that code into a .php file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fdbao/UsualToolCMS/issues/1
CVE ID: CVE-2019-6245 State: PUBLISHED Published: 2019-01-13T00:00:00 Last Updated: 2024-08-04T20:16:24.774Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Anti-Grain Geometry (AGG) 2.4 as used in SVG++ (aka svgpp) 1.2.3. In the function agg::cell_aa::not_equal, dx is assigned to (x2 - x1). If dx >= dx_limit, which is (16384 << poly_subpixel_shift), this function will call itself recursively. There can be a situation where (x2 - x1) is always bigger than dx_limit during the recursion, leading to continual stack consumption. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2019/02/msg00001.html
Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2019/02/msg00001.html - https://github.com/svgpp/svgpp/issues/70 - https://lists.debian.org/debian-lts-announce/2021/12/msg00038.html - https://lists.debian.org/debian-lts-announce/2023/04/msg00001.html
CVE ID: CVE-2019-6246 State: PUBLISHED Published: 2019-01-13T00:00:00Z Last Updated: 2024-09-16T23:05:50.236Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in SVG++ (aka svgpp) 1.2.3. After calling the gil::get_color function in Generic Image Library in Boost, the return code is used as an address, leading to an Access Violation because of an out-of-bounds read. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/svgpp/svgpp/issues/70
CVE ID: CVE-2019-6247 State: PUBLISHED Published: 2019-01-13T00:00:00Z Last Updated: 2024-09-17T02:53:28.419Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Anti-Grain Geometry (AGG) 2.4 as used in SVG++ (aka svgpp) 1.2.3. A heap-based buffer overflow bug in svgpp_agg_render may lead to code execution. In the render_scanlines_aa_solid function, the blend_hline function is called repeatedly multiple times. blend_hline is equivalent to a loop containing write operations. Each call writes a piece of heap data, and multiple calls overwrite the data in the heap. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/svgpp/svgpp/i
the data in the heap. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/svgpp/svgpp/issues/70 - https://lists.debian.org/debian-lts-announce/2023/04/msg00001.html
CVE ID: CVE-2019-6248 State: PUBLISHED Published: 2019-01-13T00:00:00Z Last Updated: 2024-09-17T00:35:58.387Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP Scripts Mall Citysearch / Hotfrog / Gelbeseiten Clone Script 2.0.1 has Reflected XSS via the srch parameter, as demonstrated by restaurants-details.php. Additional Analyst Notes: - CVE Program Container: References: - https://suku90.wordpress.com/2019/01/12/php-scripts-mall-citysearch-hotfrog-gelbeseiten-clone-script-2-0-1-reflected-xss/
CVE ID: CVE-2019-6249 State: PUBLISHED Published: 2019-01-13T15:00:00 Last Updated: 2024-08-04T20:16:24.757Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in HuCart v5.7.4. There is a CSRF vulnerability that can add an admin account via /adminsys/index.php?load=admins&act=edit_info&act_type=add. Additional Analyst Notes: - CVE Program Container: References: - http://www.iwantacve.cn/index.php/archives/109/ - https://www.exploit-db.com/exploits/46149/
CVE ID: CVE-2019-6250 State: PUBLISHED Published: 2019-01-13T15:00:00 Last Updated: 2024-08-04T20:16:24.696Z Vendors: n/a Products: n/a Problem Types: n/a Description: A pointer overflow, with code execution, was discovered in ZeroMQ libzmq (aka 0MQ) 4.2.x and 4.3.x before 4.3.1. A v2_decoder.cpp zmq::v2_decoder_t::size_ready integer overflow allows an authenticated attacker to overwrite an arbitrary amount of bytes beyond the bounds of a buffer, which can be leveraged to run arbitrary code on the target system. The memory layout allows the attacker to inject OS commands into a data structure located immediately after the problematic buffer (i.e., it is not necessary to use a typical buffer-
to a data structure located immediately after the problematic buffer (i.e., it is not necessary to use a typical buffer-overflow exploitation technique that changes the flow of control). Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2019/dsa-4368 - https://github.com/zeromq/libzmq/issues/3351 - https://github.com/zeromq/libzmq/releases/tag/v4.3.1 - https://security.gentoo.org/glsa/201903-22
CVE ID: CVE-2019-6251 State: PUBLISHED Published: 2019-01-14T07:00:00 Last Updated: 2024-08-04T20:16:24.679Z Vendors: n/a Products: n/a Problem Types: n/a Description: WebKitGTK and WPE WebKit prior to version 2.24.1 are vulnerable to address bar spoofing upon certain JavaScript redirections. An attacker could cause malicious web content to be displayed as if for a trusted URI. This is similar to the CVE-2018-8383 issue in Microsoft Edge. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.gnome.org/GNOME/epiphany/issues/532 - https://seclists.org/bugtraq/2019/Apr/21 - http://www.openwall.com/lists/oss-security/2019/04/11/1 - http://packetstormsecurity.com/files/1
g/bugtraq/2019/Apr/21 - http://www.openwall.com/lists/oss-security/2019/04/11/1 - http://packetstormsecurity.com/files/152485/WebKitGTK-WPE-WebKit-URI-Spoofing-Code-Execution.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YO5ZBUWOOXMVZPBYLZRDZF6ZQGBYJERQ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNPI3R6QWDJBA5KNGA6QSMKYLY5RRHBZ/ - https://usn.ubuntu.com/3948-1/ - https://bugs.webkit.org/show_bug.cgi?id=194208 - https://trac.webkit.org/changeset/243434 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LACVFU4MYYRPJ3IEA4UCN5KUEAGCCJ
/lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LACVFU4MYYRPJ3IEA4UCN5KUEAGCCJ72/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UO3DIA54X7FOUWFZW5YXC2MZ6KNHG6SW/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSCDI3635E37GL4BNJDRDT2KEUBDLGSO/ - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00025.html - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00031.html - https://security.gentoo.org/glsa/201909-05
CVE ID: CVE-2019-6256 State: PUBLISHED Published: 2019-01-14T07:00:00 Last Updated: 2024-08-04T20:16:24.664Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Denial of Service issue was discovered in the LIVE555 Streaming Media libraries as used in Live555 Media Server 0.93. It can cause an RTSPServer crash in handleHTTPCmd_TunnelingPOST, when RTSP-over-HTTP tunneling is supported, via x-sessioncookie HTTP headers in a GET request and a POST request within the same TCP session. This occurs because of a call to an incorrect virtual function pointer in the readSocket function in GroupsockHelper.cpp. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debi
ket function in GroupsockHelper.cpp. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2019/02/msg00037.html - https://github.com/rgaufman/live555/issues/19 - https://seclists.org/bugtraq/2019/Mar/22 - https://www.debian.org/security/2019/dsa-4408 - https://security.gentoo.org/glsa/202005-06
CVE ID: CVE-2019-6257 State: PUBLISHED Published: 2019-01-14T07:00:00Z Last Updated: 2024-09-16T16:42:44.010Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Server Side Request Forgery (SSRF) vulnerability in elFinder before 2.1.46 could allow a malicious user to access the content of internal network resources. This occurs in get_remote_contents() in php/elFinder.class.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Studio-42/elFinder/blob/68ec63c0aeca3963101aca8f842dc9f2e4c4c6d3/Changelog - https://github.com/Studio-42/elFinder/commit/2f522db8f037a66ce9040ee0b216aa4a0359286c
CVE ID: CVE-2019-6258 State: PUBLISHED Published: 2020-08-18T16:48:40 Last Updated: 2024-08-04T20:16:24.697Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-822 Rev.Bx devices with firmware v.202KRb06 and older allow a buffer overflow via long MacAddress data in a /HNAP1/SetClientInfo HNAP protocol message, which is mishandled in /usr/sbin/udhcpd during reading of the /var/servd/LAN-1-udhcpd.conf file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pr0v3rbs/CVE/tree/master/CVE-2019-6258 - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10175
CVE ID: CVE-2019-6259 State: PUBLISHED Published: 2019-01-14T14:00:00 Last Updated: 2024-08-04T20:16:24.882Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in idreamsoft iCMS V7.0.13. There is SQL Injection via the app/article/article.admincp.php _data_id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/idreamsoft/iCMS/issues/47
CVE ID: CVE-2019-6260 State: PUBLISHED Published: 2019-01-22T20:00:00 Last Updated: 2024-08-04T20:16:24.791Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ASPEED ast2400 and ast2500 Baseband Management Controller (BMC) hardware and firmware implement Advanced High-performance Bus (AHB) bridges, which allow arbitrary read and write access to the BMC's physical address space from the host (or from the network in unusual cases where the BMC console uart is attached to a serial concentrator). This CVE applies to the specific cases of iLPC2AHB bridge Pt I, iLPC2AHB bridge Pt II, PCIe VGA P2A bridge, DMA from/to arbitrary BMC memory via X-DMA, UART-based SoC Debug interface, LPC2A
AHB bridge Pt II, PCIe VGA P2A bridge, DMA from/to arbitrary BMC memory via X-DMA, UART-based SoC Debug interface, LPC2AHB bridge, PCIe BMC P2A bridge, and Watchdog setup. Additional Analyst Notes: - CVE Program Container: References: - https://www.flamingspork.com/blog/2019/01/23/cve-2019-6260:-gaining-control-of-bmc-from-the-host-processor/ - https://security.netapp.com/advisory/ntap-20190314-0001/ - https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2019-785
CVE ID: CVE-2019-6261 State: PUBLISHED Published: 2019-01-16T07:00:00 Last Updated: 2024-08-04T20:16:24.754Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Joomla! before 3.9.2. Inadequate escaping in com_contact leads to a stored XSS vulnerability. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106638 - https://developer.joomla.org/security-centre/761-20190102-core-stored-xss-in-com-contact
CVE ID: CVE-2019-6262 State: PUBLISHED Published: 2019-01-16T07:00:00 Last Updated: 2024-08-04T20:16:24.733Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Joomla! before 3.9.2. Inadequate checks of the Global Configuration helpurl settings allowed stored XSS. Additional Analyst Notes: - CVE Program Container: References: - https://developer.joomla.org/security-centre/763-20190104-core-stored-xss-issue-in-the-global-configuration-help-url - http://www.securityfocus.com/bid/106638
CVE ID: CVE-2019-6263 State: PUBLISHED Published: 2019-01-16T07:00:00 Last Updated: 2024-08-04T20:16:24.805Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Joomla! before 3.9.2. Inadequate checks of the Global Configuration Text Filter settings allowed stored XSS. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106638 - https://www.exploit-db.com/exploits/46200/ - https://developer.joomla.org/security-centre/762-20190103-core-stored-xss-issue-in-the-global-configuration-textfilter-settings
CVE ID: CVE-2019-6264 State: PUBLISHED Published: 2019-01-16T07:00:00 Last Updated: 2024-08-04T20:16:24.785Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Joomla! before 3.9.2. Inadequate escaping in mod_banners leads to a stored XSS vulnerability. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106638 - https://developer.joomla.org/security-centre/760-20190101-core-stored-xss-in-mod-banners
CVE ID: CVE-2019-6265 State: PUBLISHED Published: 2019-02-25T23:00:00 Last Updated: 2024-08-04T20:16:24.783Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Scripting and AutoUpdate functionality in Cordaware bestinformed Microsoft Windows client versions before 6.2.1.0 are affected by insecure implementations which allow remote attackers to execute arbitrary commands and escalate privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.detack.de/en/cve-2019-6265-6266
CVE ID: CVE-2019-6266 State: PUBLISHED Published: 2019-02-25T23:00:00 Last Updated: 2024-08-04T20:16:24.819Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cordaware bestinformed Microsoft Windows client before 6.2.1.0 is affected by insecure SSL certificate verification and insecure access patterns. These issues allow remote attackers to downgrade encrypted connections to cleartext. Additional Analyst Notes: - CVE Program Container: References: - https://www.detack.de/en/cve-2019-6265-6266
CVE ID: CVE-2019-6267 State: PUBLISHED Published: 2019-01-15T00:00:00 Last Updated: 2024-08-04T20:16:24.766Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Premium WP Suite Easy Redirect Manager plugin 28.07-17 for WordPress has XSS via a crafted GET request that is mishandled during log viewing at the templates/admin/redirect-log.php URI. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/easy-redirect-manager/#developers - https://www.logicallysecure.com/blog/ls-team-discovers-xss-in-wordpress-plugin/ - https://wpvulndb.com/vulnerabilities/9203
CVE ID: CVE-2019-6268 State: PUBLISHED Published: 2024-03-08T00:00:00 Last Updated: 2024-08-04T20:16:24.624Z Vendors: n/a Products: n/a Problem Types: n/a Description: RAD SecFlow-2 devices with Hardware 0202, Firmware 4.1.01.63, and U-Boot 2010.12 allow URIs beginning with /.. for Directory Traversal, as demonstrated by reading /etc/shadow. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.owasp.org/index.php/Path_Traversal - https://packetstormsecurity.com/files/177440/RAD-SecFlow-2-Path-Traversal.html
CVE ID: CVE-2019-6272 State: PUBLISHED Published: 2019-03-19T18:44:47 Last Updated: 2024-08-04T20:16:24.795Z Vendors: n/a Products: n/a Problem Types: n/a Description: Command injection vulnerability in login_cgi in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attackers to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/46179/ - http://packetstormsecurity.com/files/151207/GL-AR300M-Lite-2.2.7-Command-Injection-Directory-Traversal.html
CVE ID: CVE-2019-6273 State: PUBLISHED Published: 2019-03-19T18:51:24 Last Updated: 2024-08-04T20:16:24.849Z Vendors: n/a Products: n/a Problem Types: n/a Description: download_file in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attackers to download arbitrary files. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/46179/ - http://packetstormsecurity.com/files/151207/GL-AR300M-Lite-2.2.7-Command-Injection-Directory-Traversal.html
CVE ID: CVE-2019-6274 State: PUBLISHED Published: 2019-03-19T19:49:05 Last Updated: 2024-08-04T20:16:24.953Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in storage_cgi in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attackers to have unspecified impact via directory traversal sequences. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/46179/ - http://packetstormsecurity.com/files/151207/GL-AR300M-Lite-2.2.7-Command-Injection-Directory-Traversal.html
CVE ID: CVE-2019-6275 State: PUBLISHED Published: 2019-03-19T19:53:03 Last Updated: 2024-08-04T20:16:24.823Z Vendors: n/a Products: n/a Problem Types: n/a Description: Command injection vulnerability in firmware_cgi in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attackers to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/46179/ - http://packetstormsecurity.com/files/151207/GL-AR300M-Lite-2.2.7-Command-Injection-Directory-Traversal.html
CVE ID: CVE-2019-6278 State: PUBLISHED Published: 2019-01-14T19:00:00Z Last Updated: 2024-09-16T22:20:10.631Z Vendors: n/a Products: n/a Problem Types: n/a Description: XSS exists in JPress v1.0.4 via Markdown input, or Markdown input with the code input option. Additional Analyst Notes: - CVE Program Container: References: - https://gitee.com/fuhai/jpress/issues/IQUXE
CVE ID: CVE-2019-6279 State: PUBLISHED Published: 2019-03-19T19:57:54 Last Updated: 2024-08-04T20:16:24.801Z Vendors: n/a Products: n/a Problem Types: n/a Description: ChinaMobile PLC Wireless Router GPN2.4P21-C-CN devices with firmware W2001EN-00 have an Incorrect Access Control vulnerability via the cgi-bin/webproc?getpage=html/index.html subpage=wlsecurity URI, allowing an Attacker to change the Wireless Security Password. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/151274/PLC-Wireless-Router-GPN2.4P21-C-CN-Incorrect-Access-Control.html - https://www.youtube.com/watch?v=-cw04rOYREQ - https://www.exploit-db.com/exploits/46580/ - htt
ect-Access-Control.html - https://www.youtube.com/watch?v=-cw04rOYREQ - https://www.exploit-db.com/exploits/46580/ - http://packetstormsecurity.com/files/152166/PLC-Wireless-Router-GPN2.4P21-C-CN-Incorrect-Access-Control.html - https://0dayfindings.home.blog/2019/01/15/plc-wireless-router-gpn2-4p21-c-cn-incorrect-access-control/
CVE ID: CVE-2019-6282 State: PUBLISHED Published: 2019-03-19T20:02:24 Last Updated: 2024-08-04T20:16:24.730Z Vendors: n/a Products: n/a Problem Types: n/a Description: ChinaMobile PLC Wireless Router GPN2.4P21-C-CN devices with firmware W2001EN-00 have CSRF via the cgi-bin/webproc?getpage=html/index.html subpage=wlsecurity URI, allowing an Attacker to change the Wireless Security Password. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/151275/PLC-Wireless-Router-GPN2.4P21-C-CN-Cross-Site-Request-Forgery.html - https://www.youtube.com/watch?v=x-r4lnWPdzY - https://www.exploit-db.com/exploits/46581/ - http://packetstormsecurity.com/files/1
ww.youtube.com/watch?v=x-r4lnWPdzY - https://www.exploit-db.com/exploits/46581/ - http://packetstormsecurity.com/files/152167/PLC-Wireless-Router-GPN2.4P21-C-CN-Cross-Site-Request-Forgery.html - https://0dayfindings.home.blog/2019/01/15/plc-wireless-router-gpn2-4p21-c-cn-cross-site-request-forgery-csrf/
CVE ID: CVE-2019-6283 State: PUBLISHED Published: 2019-01-14T22:00:00 Last Updated: 2024-08-04T20:16:24.678Z Vendors: n/a Products: n/a Problem Types: n/a Description: In LibSass 3.5.5, a heap-based buffer over-read exists in Sass::Prelexer::parenthese_scope in prelexer.hpp. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sass/libsass/issues/2814 - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00047.html - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00051.html - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00027.html
CVE ID: CVE-2019-6284 State: PUBLISHED Published: 2019-01-14T22:00:00 Last Updated: 2024-08-04T20:16:24.648Z Vendors: n/a Products: n/a Problem Types: n/a Description: In LibSass 3.5.5, a heap-based buffer over-read exists in Sass::Prelexer::alternatives in prelexer.hpp. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sass/libsass/issues/2816 - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00047.html - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00051.html - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00027.html
CVE ID: CVE-2019-6285 State: PUBLISHED Published: 2019-01-14T22:00:00.000Z Last Updated: 2025-11-03T21:44:13.163Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SingleDocParser::HandleFlowSequence function in yaml-cpp (aka LibYaml-C++) 0.6.2 allows remote attackers to cause a denial of service (stack consumption and application crash) via a crafted YAML file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jbeder/yaml-cpp/issues/660
CVE ID: CVE-2019-6286 State: PUBLISHED Published: 2019-01-14T22:00:00 Last Updated: 2024-08-04T20:16:24.818Z Vendors: n/a Products: n/a Problem Types: n/a Description: In LibSass 3.5.5, a heap-based buffer over-read exists in Sass::Prelexer::skip_over_scopes in prelexer.hpp when called from Sass::Parser::parse_import(), a similar issue to CVE-2018-11693. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sass/libsass/issues/2815 - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00047.html - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00051.html - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00027.html
CVE ID: CVE-2019-6287 State: PUBLISHED Published: 2019-04-10T14:14:36 Last Updated: 2024-08-04T20:16:24.747Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Rancher 2.0.0 through 2.1.5, project members have continued access to create, update, read, and delete namespaces in a project after they have been removed from it. Additional Analyst Notes: - CVE Program Container: References: - https://rancher.com/blog/2019/2019-01-29-explaining-security-vulnerabilities-addressed-in-rancher-v2-1-6-and-v2-0-11/ - https://forums.rancher.com/c/announcements
CVE ID: CVE-2019-6288 State: PUBLISHED Published: 2021-09-22T16:38:42 Last Updated: 2024-08-04T20:16:24.678Z Vendors: n/a Products: n/a Problem Types: n/a Description: Edgecore ECS2020 Firmware 1.0.0.0 devices allow Unauthenticated Command Injection via the command1 HTTP header to the /EXCU_SHELL URI. Additional Analyst Notes: - CVE Program Container: References: - https://www.edge-core.com - https://twitter.com/r00treaver/status/1232407881464635401