Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-17635 State: PUBLISHED Published: 2020-01-17T18:35:13 Last Updated: 2024-08-05T01:47:13.610Z Vendors: The Eclipse Foundation Products: Eclipse Memory Analyzer Problem Types: CWE-502 Description: Eclipse Memory Analyzer version 1.9.1 and earlier is subject to a deserialization vulnerability if an index file of a parsed heap dump is replaced by a malicious version and the heap dump is reopened in Memory Analyzer. The user must chose to reopen an already parsed heap dump with an untrusted index for the problem to occur. The problem can be averted if the index files from an untrusted source are deleted and the heap dump is opened and reparsed. Also some local configuration data
files from an untrusted source are deleted and the heap dump is opened and reparsed. Also some local configuration data is subject to a deserialization vulnerability if the local data were to be replaced with a malicious version. This can be averted if the local configuration data stored on the file system cannot be changed by an attacker. The vulnerability could possibly allow code execution on the local system. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.eclipse.org/bugs/show_bug.cgi?id=558633
CVE ID: CVE-2019-17636 State: PUBLISHED Published: 2020-03-10T14:30:14 Last Updated: 2024-08-05T01:47:13.536Z Vendors: The Eclipse Foundation Products: Eclipse Theia Problem Types: CWE-345 Description: In Eclipse Theia versions 0.3.9 through 0.15.0, one of the default pre-packaged Theia extensions is "Mini-Browser", published as "@theia/mini-browser" on npmjs.com. This extension, for its own needs, exposes a HTTP endpoint that allows to read the content of files on the host's filesystem, given their path, without restrictions on the requester's origin. This design is vulnerable to being exploited remotely through a DNS rebinding attack or a drive-by download of a carefully crafted exploit. A
able to being exploited remotely through a DNS rebinding attack or a drive-by download of a carefully crafted exploit. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.eclipse.org/bugs/show_bug.cgi?id=551747
CVE ID: CVE-2019-17637 State: PUBLISHED Published: 2020-07-15T14:55:13 Last Updated: 2024-08-05T01:47:13.211Z Vendors: The Eclipse Foundation Products: Eclipse Web Tools Platform Problem Types: CWE-611 Description: In all versions of Eclipse Web Tools Platform through release 3.18 (2020-06), XML and DTD files referring to external entities could be exploited to send the contents of local files to a remote server when edited or validated, even when external entity resolution is disabled in the user preferences. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.eclipse.org/bugs/show_bug.cgi?id=458571 - https://lists.debian.org/debian-lts-announce/2020/10/msg00016.ht
https://bugs.eclipse.org/bugs/show_bug.cgi?id=458571 - https://lists.debian.org/debian-lts-announce/2020/10/msg00016.html
CVE ID: CVE-2019-17638 State: PUBLISHED Published: 2020-07-09T18:10:12 Last Updated: 2024-08-05T01:47:13.630Z Vendors: The Eclipse Foundation Products: Eclipse Jetty Problem Types: CWE-672, CWE-675 Description: In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too large response headers, Jetty throws an exception to produce an HTTP 431 error. When this happens, the ByteBuffer containing the HTTP response headers is released back to the ByteBufferPool twice. Because of this double release, two threads can acquire the same ByteBuffer from the pool and while thread1 is about to use the ByteBuffer to write response1 data, thread2 fills the ByteBuffer with other data. Th
d while thread1 is about to use the ByteBuffer to write response1 data, thread2 fills the ByteBuffer with other data. Thread1 then proceeds to write the buffer that now contains different data. This results in client1, which issued request1 seeing data from another request or response which could contain sensitive data belonging to client2 (HTTP session ids, authentication credentials, etc.). If the Jetty version cannot be upgraded, the vulnerability can be significantly reduced by configuring a responseHeaderSize significantly larger than the requestHeaderSize (12KB responseHeaderSize and 8KB requestHeaderSize). Additional Analyst Notes: - CVE Program Container: References: - https://bugs.e
seHeaderSize and 8KB requestHeaderSize). Additional Analyst Notes: - CVE Program Container: References: - https://bugs.eclipse.org/bugs/show_bug.cgi?id=564984 - http://www.openwall.com/lists/oss-security/2020/08/17/1 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XE6US6VPZHOWFMUSFGDS5V2DNQPY5MKB/ - https://lists.apache.org/thread.html/r4bdd3f7bb6820a79f9416b6667d718a06d269018619a75ce4b759318%40%3Ccommits.pulsar.apache.org%3E - https://lists.apache.org/thread.html/r521168299e023fb075b57afe33d17ff1d09e8a10e0fd8c775ea0e028%40%3Ccommits.pulsar.apache.org%3E - https://lists.apache.org/thread.html/r378e4cdec15e132575aa1dcb6296ffeff2a896745a899152
%3Ccommits.pulsar.apache.org%3E - https://lists.apache.org/thread.html/r378e4cdec15e132575aa1dcb6296ffeff2a896745a8991522e266ad4%40%3Ccommits.pulsar.apache.org%3E - https://lists.apache.org/thread.html/ra8661fc8c69c647cb06153c1485d48484a833d873f75dfe45937e9de%40%3Ccommits.pulsar.apache.org%3E - https://lists.apache.org/thread.html/r81f58591fb4716fb867b36956f30c7c8ad4ab3f23abc952d9d86a2a0%40%3Ccommits.pulsar.apache.org%3E - https://lists.apache.org/thread.html/r9a2cfa56d30782a0c17a5deb951a622d1f5c8de48e1c3b578ffc2a84%40%3Ccommits.pulsar.apache.org%3E - https://lists.apache.org/thread.html/rbe1f230e87ea947593145d0072d0097ddb0af10fee1161db8ca1546c%40%3Ccommits.pulsar.apache.org%3E - https://lis
rg/thread.html/rbe1f230e87ea947593145d0072d0097ddb0af10fee1161db8ca1546c%40%3Ccommits.pulsar.apache.org%3E - https://lists.apache.org/thread.html/r29073905dc9139d0d7a146595694bf57bb9e35e5ec6aa73eb9c8443a%40%3Ccommits.pulsar.apache.org%3E - https://lists.apache.org/thread.html/r7fc5f2ed49641ea91c433e3cd0fc3d31c0278c87b82b15c33b881415%40%3Ccommits.pulsar.apache.org%3E - https://lists.apache.org/thread.html/rd98cfd012490cb02caa1a11aaa0cc38bff2d43bcce9b20c2f01063dd%40%3Ccommits.pulsar.apache.org%3E - https://www.oracle.com/security-alerts/cpuoct2020.html - https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E - https://li
org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E - https://lists.apache.org/thread.html/r9584c4304c888f651d214341a939bd264ed30c9e3d0d30fe85097ecf%40%3Ccommits.pulsar.apache.org%3E - https://www.oracle.com/security-alerts/cpuApr2021.html
CVE ID: CVE-2019-17639 State: PUBLISHED Published: 2020-07-15T21:19:31 Last Updated: 2024-08-05T01:47:13.522Z Vendors: The Eclipse Foundation Products: Eclipse OpenJ9 Problem Types: CWE-843 Description: In Eclipse OpenJ9 prior to version 0.21 on Power platforms, calling the System.arraycopy method with a length longer than the length of the source or destination array can, in certain specially crafted code patterns, cause the current method to return prematurely with an undefined return value. This allows whatever value happens to be in the return register at that time to be used as if it matches the method's declared return type. Additional Analyst Notes: - CVE Program Container: References
e used as if it matches the method's declared return type. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.eclipse.org/bugs/show_bug.cgi?id=563998
CVE ID: CVE-2019-17640 State: PUBLISHED Published: 2020-10-15T20:30:15 Last Updated: 2024-08-05T01:47:13.749Z Vendors: The Eclipse Foundation Products: Eclipse Vert.x Problem Types: CWE-23 Description: In Eclipse Vert.x 3.4.x up to 3.9.4, 4.0.0.milestone1, 4.0.0.milestone2, 4.0.0.milestone3, 4.0.0.milestone4, 4.0.0.milestone5, 4.0.0.Beta1, 4.0.0.Beta2, and 4.0.0.Beta3, StaticHandler doesn't correctly processes back slashes on Windows Operating systems, allowing, escape the webroot folder to the current working directory. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.eclipse.org/bugs/show_bug.cgi?id=567416 - https://lists.apache.org/thread.html/rd0e44e8ef71eeaa
ferences: - https://bugs.eclipse.org/bugs/show_bug.cgi?id=567416 - https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E - https://lists.apache.org/thread.html/r8383b5e7344a8b872e430ad72241b84b83e9701d275c602cfe34a941%40%3Ccommits.servicecomb.apache.org%3E - https://lists.apache.org/thread.html/rfd0ebf8387cfd0b959d1e218797e709793cce51a5ea2f84d0976f47d%40%3Ccommits.pulsar.apache.org%3E - https://lists.apache.org/thread.html/r8d863b148efe778ce5f8f961d0cafeda399e681d3f0656233b4c5511%40%3Ccommits.pulsar.apache.org%3E - https://lists.apache.org/thread.html/r591f6932560c8c46cee87415afed92924a982189fea7f7c9096f8e33%40%3Ccomm
apache.org%3E - https://lists.apache.org/thread.html/r591f6932560c8c46cee87415afed92924a982189fea7f7c9096f8e33%40%3Ccommits.pulsar.apache.org%3E
CVE ID: CVE-2019-17642 State: PUBLISHED Published: 2020-03-05T16:55:32 Last Updated: 2024-08-05T01:47:13.575Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Centreon before 18.10.8, 19.10.1, and 19.04.2. It allows CSRF with resultant remote command execution via shell metacharacters in a POST to centreon-autodiscovery-server/views/scan/ajax/call.php in the Autodiscovery plugin. Additional Analyst Notes: - CVE Program Container: References: - https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.10/index.html - https://documentation.centreon.com/docs/centreon-auto-discovery/en/latest/release_notes/19.10/centreon-auto-discov
tml - https://documentation.centreon.com/docs/centreon-auto-discovery/en/latest/release_notes/19.10/centreon-auto-discovery-19.10.1.html - https://documentation.centreon.com/docs/centreon-auto-discovery/en/latest/release_notes/19.04/centreon-auto-discovery-19.04.2.html - https://documentation.centreon.com/docs/centreon-auto-discovery/en/latest/release_notes/18.10/centreon-auto-discovery-18.10.8.html
CVE ID: CVE-2019-17643 State: PUBLISHED Published: 2020-03-04T21:32:43 Last Updated: 2024-08-05T01:47:13.553Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Centreon before 2.8-30,18.10-8, 19.04-5, and 19.10-2. It provides sensitive information via an unauthenticated direct request for include/monitoring/recurrentDowntime/GetXMLHost4Services.php. Additional Analyst Notes: - CVE Program Container: References: - https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.10.html#centreon-web-19-10-2 - https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.04.html#centreon-web-19-04-5 - https://documen
umentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.04.html#centreon-web-19-04-5 - https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-18.10.html#centreon-web-18-10-8 - https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-2.8.html#centreon-web-2-8-30
CVE ID: CVE-2019-17644 State: PUBLISHED Published: 2020-03-04T21:54:24 Last Updated: 2024-08-05T01:47:13.570Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Centreon before 2.8-30, 18.10-8, 19.04-5, and 19.10-2.. It provides sensitive information via an unauthenticated direct request for include/configuration/configObject/host/refreshMacroAjax.php. Additional Analyst Notes: - CVE Program Container: References: - https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.10/index.html
CVE ID: CVE-2019-17645 State: PUBLISHED Published: 2020-03-05T16:34:55 Last Updated: 2024-08-05T01:47:13.523Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Centreon before 2.8.31, 18.10.9, 19.04.6, and 19.10.3. It provides sensitive information via an unauthenticated direct request for include/configuration/configObject/service/refreshMacroAjax.php. Additional Analyst Notes: - CVE Program Container: References: - https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.10/index.html - https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.10.html#centreon-web-19-10-2 - https://documentation.cent
centreon.com/docs/centreon/en/latest/release_notes/centreon-19.10.html#centreon-web-19-10-2 - https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.04.html#centreon-web-19-04-5 - https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-18.10.html#centreon-web-18-10-8 - https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-2.8.html#centreon-web-2-8-30 - https://github.com/centreon/centreon/pull/8035
CVE ID: CVE-2019-17646 State: PUBLISHED Published: 2020-03-05T19:49:32 Last Updated: 2024-08-05T01:47:13.562Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Centreon before 18.10.8, 19.04.5, and 19.10.2. It provides sensitive information via an unauthenticated direct request for api/external.php?object=centreon_metric&action=listByService. Additional Analyst Notes: - CVE Program Container: References: - https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.10/index.html - https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.10.html#centreon-web-19-10-2 - https://documentation.centreon.com/do
m/docs/centreon/en/latest/release_notes/centreon-19.10.html#centreon-web-19-10-2 - https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.04.html#centreon-web-19-04-5 - https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-18.10.html#centreon-web-18-10-8 - https://github.com/centreon/centreon/pull/8021
CVE ID: CVE-2019-17647 State: PUBLISHED Published: 2020-03-05T19:33:56 Last Updated: 2024-08-05T01:47:13.544Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Centreon before 2.8.30, 18.10.8, 19.04.5, and 19.10.2. SQL Injection exists via the include/monitoring/status/Hosts/xml/hostXML.php instance parameter. Additional Analyst Notes: - CVE Program Container: References: - https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.10/index.html - https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.10.html#centreon-web-19-10-2 - https://documentation.centreon.com/docs/centreon/en/latest/release_not
_notes/centreon-19.10.html#centreon-web-19-10-2 - https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.04.html#centreon-web-19-04-5 - https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-18.10.html#centreon-web-18-10-8 - https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-2.8.html#centreon-web-2-8-30 - https://github.com/centreon/centreon/pull/8063
CVE ID: CVE-2019-17650 State: PUBLISHED Published: 2019-11-21T15:03:58 Last Updated: 2024-10-25T14:27:54.500Z Vendors: Fortinet Products: FortiClient for Mac OS Problem Types: Unauthorized code execution Description: An Improper Neutralization of Special Elements used in a Command vulnerability in one of FortiClient for Mac OS root processes, may allow a local user of the system on which FortiClient is running to execute unauthorized code as root by bypassing a security check. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-19-210 - https://danishcyberdefence.dk/blog/forticlient_mac
CVE ID: CVE-2019-17651 State: PUBLISHED Published: 2020-01-28T00:44:30 Last Updated: 2024-10-25T14:03:59.971Z Vendors: Fortinet Products: Fortinet FortiSIEM Problem Types: Execute unauthorized code or commands Description: An Improper Neutralization of Input vulnerability in the description and title parameters of a Device Maintenance Schedule in FortiSIEM version 5.2.5 and below may allow a remote authenticated attacker to perform a Stored Cross Site Scripting attack (XSS) by injecting malicious JavaScript code into the description field of a Device Maintenance schedule. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG
dditional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-19-197
CVE ID: CVE-2019-17652 State: PUBLISHED Published: 2020-02-06T15:23:33 Last Updated: 2024-10-25T14:03:49.458Z Vendors: Fortinet Products: Fortinet FortiClientLinux Problem Types: Escalation of privilege Description: A stack buffer overflow vulnerability in FortiClient for Linux 6.2.1 and below may allow a user with low privilege to cause FortiClient processes running under root priviledge crashes via sending specially crafted "StartAvCustomScan" type IPC client requests to the fctsched process due the argv data not been well sanitized. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-19-238 - https://danishcyberdefen
m Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-19-238 - https://danishcyberdefence.dk/blog/forticlient_linux
CVE ID: CVE-2019-17653 State: PUBLISHED Published: 2020-03-12T22:07:43 Last Updated: 2024-10-25T14:26:44.454Z Vendors: Fortinet Products: Fortinet FortiSIEM Problem Types: Execute unauthorized code or commands Description: A Cross-Site Request Forgery (CSRF) vulnerability in the user interface of Fortinet FortiSIEM 5.2.5 could allow a remote, unauthenticated attacker to perform arbitrary actions using an authenticated user's session by persuading the victim to follow a malicious link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-19-240
CVE ID: CVE-2019-17654 State: PUBLISHED Published: 2020-03-15T22:20:58 Last Updated: 2024-10-25T14:26:07.912Z Vendors: Fortinet Products: Fortinet FortiManager Problem Types: Improper Access Control Description: An Insufficient Verification of Data Authenticity vulnerability in FortiManager 6.2.1, 6.2.0, 6.0.6 and below may allow an unauthenticated attacker to perform a Cross-Site WebSocket Hijacking (CSWSH) attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-19-191
CVE ID: CVE-2019-17655 State: PUBLISHED Published: 2020-06-16T20:14:55 Last Updated: 2024-10-25T14:24:59.077Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Fortinet Products: Fortinet FortiOS and FortiProxy Problem Types: Information disclosure Description: A cleartext storage in a file or on disk (CWE-313) vulnerability in FortiOS SSL VPN 6.2.0 through 6.2.2, 6.0.9 and earlier and FortiProxy 2.0.0, 1.2.9 and earlier may allow an attacker to retrieve a logged-in SSL VPN user's credentials should that attacker be able to read the session file stored on the targeted device's system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment:
ile stored on the targeted device's system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-19-217 - https://fortiguard.com/psirt/FG-IR-20-224
CVE ID: CVE-2019-17656 State: PUBLISHED Published: 2021-04-12T14:14:42 Last Updated: 2024-10-25T13:59:10.561Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: Fortinet Products: Fortinet FortiProxy, FortiOS Problem Types: Crash of the HTTPD service Description: A Stack-based Buffer Overflow vulnerability in the HTTPD daemon of FortiOS 6.0.10 and below, 6.2.2 and below and FortiProxy 1.0.x, 1.1.x, 1.2.9 and below, 2.0.0 and below may allow an authenticated remote attacker to crash the service by sending a malformed PUT request to the server. Fortinet is not aware of any successful exploitation of this vulnerability that would lead to code execution. Additional
Fortinet is not aware of any successful exploitation of this vulnerability that would lead to code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-19-248 - https://fortiguard.com/advisory/FG-IR-21-007
CVE ID: CVE-2019-17657 State: PUBLISHED Published: 2020-04-07T17:11:07 Last Updated: 2024-10-25T14:25:34.274Z Vendors: n/a Products: Fortinet FortiSwitch, FortiAnalyzer, FortiManager, FortiAP-S/W2 Problem Types: Denial of service Description: An Uncontrolled Resource Consumption vulnerability in Fortinet FortiSwitch below 3.6.11, 6.0.6 and 6.2.2, FortiAnalyzer below 6.2.3, FortiManager below 6.2.3 and FortiAP-S/W2 below 6.2.2 may allow an attacker to cause admin webUI denial of service (DoS) via handling special crafted HTTP requests/responses in pieces slowly, as demonstrated by Slow HTTP DoS Attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: -
ted by Slow HTTP DoS Attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-19-013
CVE ID: CVE-2019-17658 State: PUBLISHED Published: 2020-03-12T21:26:00 Last Updated: 2024-10-25T14:26:55.336Z Vendors: Fortinet Products: Fortinet FortiClientWindows Problem Types: Escalation of privilege Description: An unquoted service path vulnerability in the FortiClient FortiTray component of FortiClientWindows v6.2.2 and prior allow an attacker to gain elevated privileges via the FortiClientConsole executable service path. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-19-281
CVE ID: CVE-2019-17659 State: PUBLISHED Published: 2025-03-17T13:06:07.828Z Last Updated: 2025-03-17T13:35:08.816Z Severity: LOW (CVSS 3.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:F/RL:X/RC:X) Vendors: Fortinet Products: FortiSIEM Problem Types: CWE-798 Description: A use of hard-coded cryptographic key vulnerability in FortiSIEM version 5.2.6 may allow a remote unauthenticated attacker to obtain SSH access to the supervisor as the restricted user "tunneluser" by leveraging knowledge of the private key from another installation or a firmware image. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-19-296
CVE ID: CVE-2019-17660 State: PUBLISHED Published: 2019-10-16T15:28:25 Last Updated: 2024-08-05T01:47:13.607Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in admin/translate/translateheader_view.php in LimeSurvey 3.19.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the tolang parameter, as demonstrated by the index.php/admin/translate/sa/index/surveyid/336819/lang/ PATH_INFO. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kbgsft/vuln-limesurvey/wiki/Reflected-XSS-in-LimeSurvey-3.19.1-by-xcuter
CVE ID: CVE-2019-17661 State: PUBLISHED Published: 2019-11-08T18:00:17 Last Updated: 2024-10-15T18:36:35.309Z Vendors: n/a Products: n/a Problem Types: n/a Description: A CSV injection in the codepress-admin-columns (aka Admin Columns) plugin 3.4.6 for WordPress allows malicious users to gain remote control of other computers. By choosing formula code as his first or last name, an attacker can create a user with a name that contains malicious code. Other users might download this data as a CSV file and corrupt their PC by opening it in a tool such as Microsoft Excel. The attacker could gain remote access to the user's PC. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrich
tacker could gain remote access to the user's PC. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www2.deloitte.com/de/de/pages/risk/articles/wordpress-csv-injection.html