Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-19788 State: PUBLISHED Published: 2019-12-18T21:31:10 Last Updated: 2024-08-05T02:25:12.685Z Vendors: Opera Software AS Products: Opera for Android Problem Types: Bypass a restriction or similar Description: Opera for Android before 54.0.2669.49432 is vulnerable to a sandboxed cross-origin iframe bypass attack. By using a service working inside a sandboxed iframe it is possible to bypass the normal sandboxing attributes. This allows an attacker to make forced redirections without any user interaction from a third-party context. Additional Analyst Notes: - CVE Program Container: References: - https://security.opera.com/bypass-a-restriction-in-ofa-54-opera-security-advisories/
CVE ID: CVE-2019-19789 State: PUBLISHED Published: 2019-12-20T12:43:29 Last Updated: 2024-08-05T02:25:12.710Z Vendors: n/a Products: n/a Problem Types: n/a Description: 3S-Smart CODESYS SP Realtime NT before V2.3.7.28, CODESYS Runtime Toolkit 32 bit full before V2.4.7.54, and CODESYS PLCWinNT before V2.4.7.54 allow a NULL pointer dereference. Additional Analyst Notes: - CVE Program Container: References: - https://www.codesys.com - https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=12946&token=edd5d8e821edaf3189d36bb1cac1aa1bfc42351f&download=
CVE ID: CVE-2019-19790 State: PUBLISHED Published: 2019-12-13T17:06:38 Last Updated: 2024-08-05T02:25:12.691Z Vendors: n/a Products: n/a Problem Types: n/a Description: Path traversal in RadChart in Telerik UI for ASP.NET AJAX allows a remote attacker to read and delete an image with extension .BMP, .EXIF, .GIF, .ICON, .JPEG, .PNG, .TIFF, or .WMF on the server through a specially crafted request. NOTE: RadChart was discontinued in 2014 in favor of RadHtmlChart. All RadChart versions were affected. To avoid this vulnerability, you must remove RadChart's HTTP handler from a web.config (its type is Telerik.Web.UI.ChartHttpHandler). Additional Analyst Notes: - CVE Program Container: References:
eb.config (its type is Telerik.Web.UI.ChartHttpHandler). Additional Analyst Notes: - CVE Program Container: References: - https://www.telerik.com/forums/path-traversal-vulnerability-in-radchart-image-handler - https://docs.telerik.com/devtools/aspnet-ajax/controls/chart/overview - https://www.telerik.com/forums/-620f6977edef
CVE ID: CVE-2019-19791 State: PUBLISHED Published: 2023-05-29T00:00:00 Last Updated: 2025-01-14T17:56:24.382Z Vendors: n/a Products: n/a Problem Types: n/a Description: In LemonLDAP::NG (aka lemonldap-ng) before 2.0.7, the default Apache HTTP Server configuration does not properly restrict access to SOAP/REST endpoints (when some LemonLDAP::NG setup options are used). For example, an attacker can insert index.fcgi/index.fcgi into a URL to bypass a Require directive. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/issues/1943 - https://projects.ow2.org/view/lemonldap-ng/lemonldap-ng-2-0-7-is-out
CVE ID: CVE-2019-19792 State: PUBLISHED Published: 2020-03-03T14:32:48 Last Updated: 2024-08-05T02:25:12.696Z Severity: MEDIUM (CVSS 5.2 CVSS:3.0/AC:L/AV:L/A:L/C:L/I:L/PR:H/S:C/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: A permissions issue in ESET Cyber Security before 6.8.300.0 for macOS allows a local attacker to escalate privileges by appending data to root-owned files. Additional Analyst Notes: - CVE Program Container: References: - https://danishcyberdefence.dk/blog/esets-cyber-security
CVE ID: CVE-2019-19793 State: PUBLISHED Published: 2019-12-13T17:34:26 Last Updated: 2024-08-05T02:25:12.713Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Cyxtera AppGate SDP Client 4.1.x through 4.3.x before 4.3.2 on Windows, a local or remote user from the same domain can gain privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.cyxtera.com/pdfs/appgate-sa-2019-07-0001.pdf - https://danishcyberdefence.dk/blog/appgate_part1
CVE ID: CVE-2019-19794 State: PUBLISHED Published: 2019-12-13T21:46:59 Last Updated: 2024-08-05T02:25:12.686Z Vendors: n/a Products: n/a Problem Types: n/a Description: The miekg Go DNS package before 1.1.25, as used in CoreDNS before 1.6.6 and other products, improperly generates random numbers because math/rand is used. The TXID becomes predictable, leading to response forgeries. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/miekg/dns/issues/1043 - https://github.com/coredns/coredns/issues/3519 - https://github.com/miekg/dns/pull/1044 - https://github.com/miekg/dns/compare/v1.1.24...v1.1.25 - https://github.com/coredns/coredns/issues/3547
CVE ID: CVE-2019-19795 State: PUBLISHED Published: 2019-12-13T21:59:13 Last Updated: 2024-08-05T02:25:12.688Z Vendors: n/a Products: n/a Problem Types: n/a Description: samurai 0.7 has a heap-based buffer overflow in canonpath in util.c via a crafted build file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/michaelforney/samurai/issues/29
CVE ID: CVE-2019-19796 State: PUBLISHED Published: 2019-12-13T21:59:29 Last Updated: 2024-08-05T02:25:12.690Z Vendors: n/a Products: n/a Problem Types: n/a Description: Yabasic 2.86.2 has a heap-based buffer overflow in myformat in function.c via a crafted BASIC source file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/marcIhm/yabasic/issues/37
CVE ID: CVE-2019-19797 State: PUBLISHED Published: 2019-12-15T19:53:41 Last Updated: 2024-08-05T02:25:12.696Z Vendors: n/a Products: n/a Problem Types: n/a Description: read_colordef in read.c in Xfig fig2dev 3.2.7b has an out-of-bounds write. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/mcj/tickets/67/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ILJM2G6NM5MMBKTT5CH23TAI6DJGNW36/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7XOY5NXUZ6JRBBPYA3CXWGRGQTSDVVG2/ - https://lists.debian.org/debian-lts-announce/2021/10/msg00002.html
CVE ID: CVE-2019-19799 State: PUBLISHED Published: 2020-03-13T16:18:12 Last Updated: 2024-08-05T02:25:12.677Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine Applications Manager before 14600 allows a remote unauthenticated attacker to disclose license related information via WieldFeedServlet servlet. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/eLeN3Re/cve-2019-19799 - https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2019-19799.html
CVE ID: CVE-2019-19800 State: PUBLISHED Published: 2020-02-06T16:06:41 Last Updated: 2024-08-05T02:25:12.715Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine Applications Manager 14 before 14520 allows a remote unauthenticated attacker to disclose OS file names via FailOverHelperServlet. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com - https://gitlab.com/eLeN3Re/CVE-2019-19800/ - https://www.manageengine.com/products/applications_manager/release-notes.html
CVE ID: CVE-2019-19801 State: PUBLISHED Published: 2020-01-17T01:55:00 Last Updated: 2024-08-05T02:25:12.932Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Gallagher Command Centre Server versions of v8.10 prior to v8.10.1134(MR4), v8.00 prior to v8.00.1161(MR5), v7.90 prior to v7.90.991(MR5), v7.80 prior to v7.80.960(MR2) and v7.70 or earlier, an unprivileged but authenticated user is able to perform a backup of the Command Centre databases. Additional Analyst Notes: - CVE Program Container: References: - https://security.gallagher.com/cve-2019-19801
CVE ID: CVE-2019-19802 State: PUBLISHED Published: 2020-01-17T02:00:30 Last Updated: 2024-08-05T02:25:12.701Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Gallagher Command Centre Server v8.10 prior to v8.10.1134(MR4), v8.00 prior to v8.00.1161(MR5), v7.90 prior to v7.90.991(MR5), v7.80 prior to v7.80.960(MR2) and v7.70 or earlier, an authenticated user connecting to OPCUA can view all data that would be replicated in a multi-server setup without privilege checks being applied. Additional Analyst Notes: - CVE Program Container: References: - https://security.gallagher.com/cve-2019-19802
CVE ID: CVE-2019-19805 State: PUBLISHED Published: 2019-12-30T17:05:02 Last Updated: 2024-08-05T02:25:12.764Z Vendors: n/a Products: n/a Problem Types: n/a Description: _account_forgot_password.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.3 takes a different amount of time to return depending on whether an email address is configured for the account name provided. This can be used by an attacker to enumerate accounts by guessing email addresses. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40jra8908/yetishare-3-5-2-4-5-3-multiple-vulnerabilities-2d01d0cd7459
CVE ID: CVE-2019-19806 State: PUBLISHED Published: 2019-12-30T17:07:08 Last Updated: 2024-08-05T02:25:12.673Z Vendors: n/a Products: n/a Problem Types: n/a Description: _account_forgot_password.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.3 displays a message indicating whether an email address is configured for the account name provided. This can be used by an attacker to enumerate accounts by guessing email addresses. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40jra8908/yetishare-3-5-2-4-5-3-multiple-vulnerabilities-2d01d0cd7459
CVE ID: CVE-2019-19807 State: PUBLISHED Published: 2019-12-15T22:59:14 Last Updated: 2024-08-05T02:25:12.799Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Linux kernel before 5.3.11, sound/core/timer.c has a use-after-free caused by erroneous code refactoring, aka CID-e7af6307a8a5. This is related to snd_timer_open and snd_timer_close_locked. The timeri variable was originally intended to be for a newly created timer instance, but was used for a different purpose after refactoring. Additional Analyst Notes: - CVE Program Container: References: - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.11 - https://github.com/torvalds/linux/commit/e7af6307a8a54f0b873960
/cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.11 - https://github.com/torvalds/linux/commit/e7af6307a8a54f0b873960b32b6a644f2d0fbd97 - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e7af6307a8a54f0b873960b32b6a644f2d0fbd97 - https://security.netapp.com/advisory/ntap-20200103-0001/ - https://usn.ubuntu.com/4227-1/ - https://usn.ubuntu.com/4225-1/ - https://usn.ubuntu.com/4227-2/
CVE ID: CVE-2019-19810 State: PUBLISHED Published: 2021-10-28T10:23:08 Last Updated: 2024-08-05T02:25:12.696Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoom Call Recording 6.3.1 from Eleveo is vulnerable to Java Deserialization attacks targeting the inbuilt RMI service. A remote unauthenticated attacker can exploit this vulnerability by sending crafted RMI requests to execute arbitrary code on the target host. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-19810-Java%20RMI%20Deserialization-ZoomCallRecording
CVE ID: CVE-2019-19813 State: PUBLISHED Published: 2019-12-17T05:43:52 Last Updated: 2024-08-05T02:25:12.703Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image, performing some operations, and then making a syncfs system call can lead to a use-after-free in __mutex_lock in kernel/locking/mutex.c. This is related to mutex_can_spin_on_owner in kernel/locking/mutex.c, __btrfs_qgroup_free_meta in fs/btrfs/qgroup.c, and btrfs_insert_delayed_items in fs/btrfs/delayed-inode.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bobfuzzer/CVE/tree/master/CVE-2019-19813 - https://security.ne
- CVE Program Container: References: - https://github.com/bobfuzzer/CVE/tree/master/CVE-2019-19813 - https://security.netapp.com/advisory/ntap-20200103-0001/ - https://usn.ubuntu.com/4414-1/ - https://lists.debian.org/debian-lts-announce/2020/09/msg00025.html - https://lists.debian.org/debian-lts-announce/2021/03/msg00010.html
CVE ID: CVE-2019-19814 State: PUBLISHED Published: 2019-12-17T05:27:41 Last Updated: 2024-08-05T02:25:12.786Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Linux kernel 5.0.21, mounting a crafted f2fs filesystem image can cause __remove_dirty_segment slab-out-of-bounds write access because an array is bounded by the number of dirty types (8) but the array index can exceed this. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bobfuzzer/CVE/tree/master/CVE-2019-19814 - https://security.netapp.com/advisory/ntap-20200103-0001/
CVE ID: CVE-2019-19815 State: PUBLISHED Published: 2019-12-17T06:29:27 Last Updated: 2024-08-05T02:25:12.694Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Linux kernel 5.0.21, mounting a crafted f2fs filesystem image can cause a NULL pointer dereference in f2fs_recover_fsync_data in fs/f2fs/recovery.c. This is related to F2FS_P_SB in fs/f2fs/f2fs.h. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bobfuzzer/CVE/tree/master/CVE-2019-19815 - https://github.com/torvalds/linux/commit/4969c06a0d83c9c3dc50b8efcdc8eeedfce896f6#diff-41a7fa4590d2af87e82101f2b4dadb56 - https://security.netapp.com/advisory/ntap-20200103-0001/
CVE ID: CVE-2019-19816 State: PUBLISHED Published: 2019-12-17T05:58:39 Last Updated: 2024-08-05T02:25:12.674Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image and performing some operations can cause slab-out-of-bounds write access in __btrfs_map_block in fs/btrfs/volumes.c, because a value of 1 for the number of data stripes is mishandled. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bobfuzzer/CVE/tree/master/CVE-2019-19816 - https://security.netapp.com/advisory/ntap-20200103-0001/ - https://usn.ubuntu.com/4414-1/ - https://lists.debian.org/debian-lts-announce/2020/09/msg00
visory/ntap-20200103-0001/ - https://usn.ubuntu.com/4414-1/ - https://lists.debian.org/debian-lts-announce/2020/09/msg00025.html - https://lists.debian.org/debian-lts-announce/2020/12/msg00015.html - https://lists.debian.org/debian-lts-announce/2021/03/msg00010.html
CVE ID: CVE-2019-19817 State: PUBLISHED Published: 2019-12-16T20:08:00 Last Updated: 2024-08-05T02:25:12.694Z Vendors: n/a Products: n/a Problem Types: n/a Description: The JBIG2Decode library in npdf.dll in Nitro Free PDF Reader 12.0.0.112 has a CAPPDAnnotHandlerUtils::PDAnnotHandlerDestroyData2+0x2e8a Out-of-Bounds Read via crafted Unicode content. Additional Analyst Notes: - CVE Program Container: References: - https://nafiez.github.io/security/vulnerability/remote/2019/12/12/multiple-nitro-pdf-vulnerability.html - https://github.com/nafiez/nafiez.github.io/blob/master/_posts/2019-12-12-multiple-nitro-pdf-vulnerability.md
CVE ID: CVE-2019-19818 State: PUBLISHED Published: 2019-12-16T20:07:23 Last Updated: 2024-08-05T02:25:12.706Z Vendors: n/a Products: n/a Problem Types: n/a Description: The JBIG2Decode library in npdf.dll in Nitro Free PDF Reader 12.0.0.112 has a CAPPDAnnotHandlerUtils::PDAnnotHandlerDestroyData2+0xa08a Out-of-Bounds Read via crafted Unicode content. Additional Analyst Notes: - CVE Program Container: References: - https://nafiez.github.io/security/vulnerability/remote/2019/12/12/multiple-nitro-pdf-vulnerability.html - https://github.com/nafiez/nafiez.github.io/blob/master/_posts/2019-12-12-multiple-nitro-pdf-vulnerability.md
CVE ID: CVE-2019-19819 State: PUBLISHED Published: 2019-12-16T20:07:49 Last Updated: 2024-08-05T02:25:12.683Z Vendors: n/a Products: n/a Problem Types: n/a Description: The JBIG2Globals library in npdf.dll in Nitro Free PDF Reader 12.0.0.112 has a CAPPDAnnotHandlerUtils::PDAnnotHandlerDestroyData2+0x90ec NULL Pointer Dereference via crafted Unicode content. Additional Analyst Notes: - CVE Program Container: References: - https://nafiez.github.io/security/vulnerability/remote/2019/12/12/multiple-nitro-pdf-vulnerability.html - https://github.com/nafiez/nafiez.github.io/blob/master/_posts/2019-12-12-multiple-nitro-pdf-vulnerability.md
CVE ID: CVE-2019-19820 State: PUBLISHED Published: 2019-12-16T20:07:36 Last Updated: 2024-08-05T02:25:12.695Z Vendors: n/a Products: n/a Problem Types: n/a Description: An invalid pointer vulnerability in IOCTL Handling in the kyrld.sys driver in Kyrol Internet Security 9.0.6.9 allows an attacker to achieve privilege escalation, denial-of-service, and code execution via usermode because 0x9C402405 using METHOD_NEITHER results in a read primitive. Additional Analyst Notes: - CVE Program Container: References: - https://nafiez.github.io/security/vulnerability/2019/12/04/kyrol-internet-security-invalid-pointer-vulnerability.html - https://github.com/nafiez/nafiez.github.io/blob/master/_posts/20
-internet-security-invalid-pointer-vulnerability.html - https://github.com/nafiez/nafiez.github.io/blob/master/_posts/2019-12-04-kyrol-internet-security-invalid-pointer-vulnerability.md
CVE ID: CVE-2019-19821 State: PUBLISHED Published: 2020-03-16T17:15:50 Last Updated: 2024-08-05T02:25:12.773Z Vendors: n/a Products: n/a Problem Types: n/a Description: A post-authentication privilege escalation in the web application of Combodo iTop allows regular authenticated users to access information and modify information with administrative privileges by not following the HTTP Location header in server responses. This is fixed in all iTop packages (community, essential, professional) in versions : 2.5.4, 2.6.3, 2.7.0 Additional Analyst Notes: - CVE Program Container: References: - https://www.combodo.com/itop-193 - https://www.pentagrid.ch/de/blog/security_issues_in_teampasswordmanag
: References: - https://www.combodo.com/itop-193 - https://www.pentagrid.ch/de/blog/security_issues_in_teampasswordmanager_and_combodo_itop/ - https://github.com/Combodo/iTop/security/advisories/GHSA-2gfp-2qvh-9796
CVE ID: CVE-2019-19822 State: PUBLISHED Published: 2020-01-27T17:55:12 Last Updated: 2024-08-05T02:25:12.713Z Vendors: n/a Products: n/a Problem Types: n/a Description: A certain router administration interface (that includes Realtek APMIB 0.11f for Boa 0.94.14rc21) allows remote attackers to retrieve the configuration, including sensitive data (usernames and passwords). This affects TOTOLINK A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, and N100RE through 3.4.0; Rutek RTK 11N AP through 2019-12-12; Sapido GR297n through 2019-12-12; CIK TELECOM MESH ROUTER through 2019-12-12; KCTVJEJU W
RTK 11N AP through 2019-12-12; Sapido GR297n through 2019-12-12; CIK TELECOM MESH ROUTER through 2019-12-12; KCTVJEJU Wireless AP through 2019-12-12; Fibergate FGN-R2 through 2019-12-12; Hi-Wifi MAX-C300N through 2019-12-12; HCN MAX-C300N through 2019-12-12; T-broad GN-866ac through 2019-12-12; Coship EMTA AP through 2019-12-12; and IO-Data WN-AC1167R through 2019-12-12. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Saturn49/wecb/blob/755ce19a493c78270c04b5aaf39664f0cddbb420/rtl819x/users/boa/apmib/apmib.h#L13 - http://opensource.actiontec.com/sourcecode/wcb3000x/wecb3000n_gpl_0.16.8.4.tgz - https://sploit.tech - http://seclists.org/fulldisclosure/2020/
ntec.com/sourcecode/wcb3000x/wecb3000n_gpl_0.16.8.4.tgz - https://sploit.tech - http://seclists.org/fulldisclosure/2020/Jan/36 - http://packetstormsecurity.com/files/156083/Realtek-SDK-Information-Disclosure-Code-Execution.html - http://seclists.org/fulldisclosure/2020/Jan/38
CVE ID: CVE-2019-19823 State: PUBLISHED Published: 2020-01-27T17:49:21 Last Updated: 2024-08-05T02:25:12.888Z Vendors: n/a Products: n/a Problem Types: n/a Description: A certain router administration interface (that includes Realtek APMIB 0.11f for Boa 0.94.14rc21) stores cleartext administrative passwords in flash memory and in a file. This affects TOTOLINK A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, and N100RE through 3.4.0; Rutek RTK 11N AP through 2019-12-12; Sapido GR297n through 2019-12-12; CIK TELECOM MESH ROUTER through 2019-12-12; KCTVJEJU Wireless AP through 2019-12-12; Fib
pido GR297n through 2019-12-12; CIK TELECOM MESH ROUTER through 2019-12-12; KCTVJEJU Wireless AP through 2019-12-12; Fibergate FGN-R2 through 2019-12-12; Hi-Wifi MAX-C300N through 2019-12-12; HCN MAX-C300N through 2019-12-12; T-broad GN-866ac through 2019-12-12; Coship EMTA AP through 2019-12-12; and IO-Data WN-AC1167R through 2019-12-12. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Saturn49/wecb/blob/755ce19a493c78270c04b5aaf39664f0cddbb420/rtl819x/users/boa/apmib/apmib.h#L13 - http://opensource.actiontec.com/sourcecode/wcb3000x/wecb3000n_gpl_0.16.8.4.tgz - https://sploit.tech - http://seclists.org/fulldisclosure/2020/Jan/36 - http://packetstormsecurit
000n_gpl_0.16.8.4.tgz - https://sploit.tech - http://seclists.org/fulldisclosure/2020/Jan/36 - http://packetstormsecurity.com/files/156083/Realtek-SDK-Information-Disclosure-Code-Execution.html - http://seclists.org/fulldisclosure/2020/Jan/38
CVE ID: CVE-2019-19824 State: PUBLISHED Published: 2020-01-27T17:03:58 Last Updated: 2024-08-28T18:03:26.209Z Vendors: n/a Products: n/a Problem Types: n/a Description: On certain TOTOLINK Realtek SDK based routers, an authenticated attacker may execute arbitrary OS commands via the sysCmd parameter to the boafrm/formSysCmd URI, even if the GUI (syscmd.htm) is not available. This allows for full control over the device's internals. This affects A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, N100RE through 3.4.0, and N302RE 2.0.2. Additional Analyst Notes: - CVE Program Container: - CISA
N150RT through 3.4.0, N100RE through 3.4.0, and N302RE 2.0.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sploit.tech - http://seclists.org/fulldisclosure/2020/Jan/36 - http://packetstormsecurity.com/files/156083/Realtek-SDK-Information-Disclosure-Code-Execution.html - http://seclists.org/fulldisclosure/2020/Jan/38 - https://github.com/yckuo-sdc/totolink-boa-api-vulnerabilities
CVE ID: CVE-2019-19825 State: PUBLISHED Published: 2020-01-27T16:50:28 Last Updated: 2024-08-05T02:25:12.701Z Vendors: n/a Products: n/a Problem Types: n/a Description: On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via an {"topicurl":"setting/getSanvas"} POST to the boafrm/formLogin URI, leading to a CAPTCHA bypass. (Also, the CAPTCHA text is not needed once the attacker has determined valid credentials. The attacker can perform router actions via HTTP requests with Basic Authentication.) This affects A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, and N
.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, and N100RE through 3.4.0. Additional Analyst Notes: - CVE Program Container: References: - https://sploit.tech - http://seclists.org/fulldisclosure/2020/Jan/36 - http://packetstormsecurity.com/files/156083/Realtek-SDK-Information-Disclosure-Code-Execution.html - http://seclists.org/fulldisclosure/2020/Jan/38