Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-17592 State: PUBLISHED Published: 2019-10-14T19:59:21 Last Updated: 2024-08-05T01:47:13.236Z Vendors: n/a Products: n/a Problem Types: n/a Description: The csv-parse module before 4.4.6 for Node.js is vulnerable to Regular Expression Denial of Service. The __isInt() function contains a malformed regular expression that processes large crafted input very slowly. This is triggered when using the cast option. Additional Analyst Notes: - CVE Program Container: References: - https://www.npmjs.com/advisories/1171 - https://github.com/adaltas/node-csv-parse/commit/b9d35940c6815cdf1dfd6b21857a1f6d0fd51e4a - https://security.netapp.com/advisory/ntap-20191127-0002/ - https://lists.fed
/b9d35940c6815cdf1dfd6b21857a1f6d0fd51e4a - https://security.netapp.com/advisory/ntap-20191127-0002/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z36UKPO5F3PQ3Q2POMF5LEKXWAH5RUFP/
CVE ID: CVE-2019-17593 State: PUBLISHED Published: 2019-10-14T20:07:21 Last Updated: 2024-08-05T01:47:13.224Z Vendors: n/a Products: n/a Problem Types: n/a Description: JIZHICMS 1.5.1 allows admin.php/Admin/adminadd.html CSRF to add an administrator. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Cherry-toto/jizhicms/issues/1
CVE ID: CVE-2019-17594 State: PUBLISHED Published: 2019-10-14T20:43:11 Last Updated: 2024-08-05T01:47:13.180Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a heap-based buffer over-read in the _nc_find_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012. Additional Analyst Notes: - CVE Program Container: References: - https://lists.gnu.org/archive/html/bug-ncurses/2019-10/msg00017.html - https://lists.gnu.org/archive/html/bug-ncurses/2019-10/msg00045.html - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00059.html - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00061.html - https://security.gentoo
-11/msg00059.html - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00061.html - https://security.gentoo.org/glsa/202101-28
CVE ID: CVE-2019-17595 State: PUBLISHED Published: 2019-10-14T20:42:57 Last Updated: 2024-08-05T01:47:13.250Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012. Additional Analyst Notes: - CVE Program Container: References: - https://lists.gnu.org/archive/html/bug-ncurses/2019-10/msg00045.html - https://lists.gnu.org/archive/html/bug-ncurses/2019-10/msg00013.html - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00059.html - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00061.html - https://security.gentoo.org/
sg00059.html - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00061.html - https://security.gentoo.org/glsa/202101-28
CVE ID: CVE-2019-17596 State: PUBLISHED Published: 2019-10-24T21:07:25 Last Updated: 2024-08-05T01:47:13.228Z Vendors: n/a Products: n/a Problem Types: n/a Description: Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key. There are several attack scenarios, such as traffic from a client to a server that verifies client certificates. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/d/msg/golang-announce/lVEm7llp0w0/VbafyRkgCgAJ - https://github.com/golang/go/issues/34960 - https://www.debian.org/security/2019/dsa-4551 - https://lists.fedoraproject.org/archives/list/package
/go/issues/34960 - https://www.debian.org/security/2019/dsa-4551 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5VS3HPSE25ZSGS4RSOTADC67YNOHIGVV/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WVOWGM7IQGRO7DS2MCUMYZRQ4TYOZNAS/ - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00043.html - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00044.html - https://security.netapp.com/advisory/ntap-20191122-0005/ - https://access.redhat.com/errata/RHSA-2020:0101 - https://access.redhat.com/errata/RHSA-2020:0329 - https://lists.debian.org/debian-lts-announce/2021/03/m
HSA-2020:0101 - https://access.redhat.com/errata/RHSA-2020:0329 - https://lists.debian.org/debian-lts-announce/2021/03/msg00014.html - https://lists.debian.org/debian-lts-announce/2021/03/msg00015.html - https://www.arista.com/en/support/advisories-notices/security-advisories/10134-security-advisory-46
CVE ID: CVE-2019-17598 State: PUBLISHED Published: 2019-11-05T14:53:19 Last Updated: 2024-08-05T01:47:13.130Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Lightbend Play Framework 2.5.x through 2.6.23. When configured to make requests using an authenticated HTTP proxy, play-ws may sometimes, typically under high load, when connecting to a target host using https, expose the proxy credentials to the target host. Additional Analyst Notes: - CVE Program Container: References: - https://www.playframework.com/security/vulnerability - https://www.playframework.com/security/vulnerability/CVE-2019-17598-PlayWSHttpConnectAuthorizationHeaders
CVE ID: CVE-2019-17599 State: PUBLISHED Published: 2019-12-13T13:30:03 Last Updated: 2024-08-05T01:47:13.311Z Vendors: n/a Products: n/a Problem Types: n/a Description: The quiz-master-next (aka Quiz And Survey Master) plugin before 6.3.5 for WordPress is affected by: Cross Site Scripting (XSS). The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via the from or till parameter (and/or the quiz_id parameter). The component is: admin/quiz-options-page.php. The attack vector is: When the Administrator is logged in, a reflected XSS may execute upon a click on a malicious URL. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugin
click on a malicious URL. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/quiz-master-next/#developers - https://github.com/QuizandSurveyMaster/quiz_master_next/issues/795 - https://github.com/QuizandSurveyMaster/quiz_master_next/pull/796 - https://wpvulndb.com/vulnerabilities/9977
CVE ID: CVE-2019-17600 State: PUBLISHED Published: 2019-10-15T13:54:17 Last Updated: 2024-08-05T01:47:13.130Z Vendors: n/a Products: n/a Problem Types: n/a Description: Intelbras IWR 1000N 1.6.4 devices allow disclosure of the administrator login name and password because v1/system/user is mishandled. Additional Analyst Notes: - CVE Program Container: References: - https://pastebin.com/QbhVPyXm - https://www.exploit-db.com/exploits/46770/
CVE ID: CVE-2019-17601 State: PUBLISHED Published: 2019-10-15T20:49:16 Last Updated: 2024-08-05T01:47:13.467Z Vendors: n/a Products: n/a Problem Types: n/a Description: In MiniShare 1.4.1, there is a stack-based buffer overflow via an HTTP CONNECT request, which allows an attacker to achieve arbitrary code execution, a similar issue to CVE-2018-19862 and CVE-2018-19861. NOTE: this product is discontinued. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/154819/MiniShare-1.4.1-CONNECT-Remote-Buffer-Overflow.html
CVE ID: CVE-2019-17602 State: PUBLISHED Published: 2019-10-15T21:00:15 Last Updated: 2024-08-05T01:47:13.363Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Zoho ManageEngine OpManager before 12.4 build 124089. The OPMDeviceDetailsServlet servlet is prone to SQL injection. Depending on the configuration, this vulnerability could be exploited unauthenticated or authenticated. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/network-monitoring/help/read-me-complete.html
CVE ID: CVE-2019-17603 State: PUBLISHED Published: 2020-06-02T14:47:03 Last Updated: 2024-08-05T01:47:13.513Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ene.sys in Asus Aura Sync through 1.07.71 does not properly validate input to IOCTL 0x80102044, 0x80102050, and 0x80102054, which allows local users to cause a denial of service (system crash) or gain privileges via IOCTL requests using crafted kernel addresses that trigger memory corruption. Additional Analyst Notes: - CVE Program Container: References: - https://zer0-day.pw/2020-06/asus-aura-sync-stack-based-buffer-overflow/ - http://packetstormsecurity.com/files/158221/ASUS-Aura-Sync-1.07.71-Privilege-Escalation.html
CVE ID: CVE-2019-17604 State: PUBLISHED Published: 2019-11-07T15:24:34 Last Updated: 2024-08-05T01:47:13.129Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Insecure Direct Object Reference (IDOR) vulnerability in eyecomms eyeCMS through 2019-10-15 allows any candidate to change other candidates' personal information (first name, last name, email, CV, phone number, and all other personal information) by changing the value of the candidate id (the id parameter). Additional Analyst Notes: - CVE Program Container: References: - http://www.eyecomms.com/Products/eyeCMS.html - https://gist.github.com/AhMyth/b0f7e4b8244def8eb8d7d8c61fa6d4e5
CVE ID: CVE-2019-17605 State: PUBLISHED Published: 2019-11-07T15:21:03 Last Updated: 2024-08-05T01:47:13.225Z Vendors: n/a Products: n/a Problem Types: n/a Description: A mass assignment vulnerability in eyecomms eyeCMS through 2019-10-15 allows any candidate to take over another candidate's account (by also exploiting CVE-2019-17604) via a modified candidate id and an additional password parameter. The outcome is that the password of this other candidate is changed. Additional Analyst Notes: - CVE Program Container: References: - http://www.eyecomms.com/Products/eyeCMS.html - https://gist.github.com/AhMyth/6d9c5e15d943dd092ccca19fca8d5d37
CVE ID: CVE-2019-17606 State: PUBLISHED Published: 2019-10-23T16:18:14 Last Updated: 2024-08-05T01:47:13.203Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Post editor functionality in the hexo-admin plugin versions 2.3.0 and earlier for Node.js is vulnerable to stored XSS via the content of a post. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jaredly/hexo-admin/commits/master - https://www.npmjs.com/advisories - https://mega.nz/#%218MYnUQzC%21ZCqixrGyHdBhimCmrszSXdFmI2feImhuZZMcnplNBQQ - https://www.npmjs.com/advisories/1211
CVE ID: CVE-2019-17607 State: PUBLISHED Published: 2019-10-16T21:13:56 Last Updated: 2024-08-05T01:47:13.224Z Vendors: n/a Products: n/a Problem Types: n/a Description: HongCMS 3.0.0 has XSS via the install/index.php servername parameter. Additional Analyst Notes: - CVE Program Container: References: - https://cdn1.imggmi.com/uploads/2019/10/13/94ef1b084a074ffd9ef63408529aed17-full.png - https://cdn1.imggmi.com/uploads/2019/10/13/e561884443c495286993e186f44dfd1f-full.png - https://cxsecurity.com/issue/WLB-2019100100
CVE ID: CVE-2019-17608 State: PUBLISHED Published: 2019-10-16T21:15:35 Last Updated: 2024-08-05T01:47:13.221Z Vendors: n/a Products: n/a Problem Types: n/a Description: HongCMS 3.0.0 has XSS via the install/index.php dbname parameter. Additional Analyst Notes: - CVE Program Container: References: - https://cdn1.imggmi.com/uploads/2019/10/13/94ef1b084a074ffd9ef63408529aed17-full.png - https://cdn1.imggmi.com/uploads/2019/10/13/e561884443c495286993e186f44dfd1f-full.png - https://cxsecurity.com/issue/WLB-2019100100
CVE ID: CVE-2019-17609 State: PUBLISHED Published: 2019-10-16T21:17:06 Last Updated: 2024-08-05T01:47:13.224Z Vendors: n/a Products: n/a Problem Types: n/a Description: HongCMS 3.0.0 has XSS via the install/index.php dbusername parameter. Additional Analyst Notes: - CVE Program Container: References: - https://cdn1.imggmi.com/uploads/2019/10/13/94ef1b084a074ffd9ef63408529aed17-full.png - https://cdn1.imggmi.com/uploads/2019/10/13/e561884443c495286993e186f44dfd1f-full.png - https://cxsecurity.com/issue/WLB-2019100100
CVE ID: CVE-2019-17610 State: PUBLISHED Published: 2019-10-16T21:18:16 Last Updated: 2024-08-05T01:47:13.226Z Vendors: n/a Products: n/a Problem Types: n/a Description: HongCMS 3.0.0 has XSS via the install/index.php dbpassword parameter. Additional Analyst Notes: - CVE Program Container: References: - https://cdn1.imggmi.com/uploads/2019/10/13/94ef1b084a074ffd9ef63408529aed17-full.png - https://cdn1.imggmi.com/uploads/2019/10/13/e561884443c495286993e186f44dfd1f-full.png - https://cxsecurity.com/issue/WLB-2019100100
CVE ID: CVE-2019-17611 State: PUBLISHED Published: 2019-10-16T21:19:31 Last Updated: 2024-08-05T01:47:13.198Z Vendors: n/a Products: n/a Problem Types: n/a Description: HongCMS 3.0.0 has XSS via the install/index.php tableprefix parameter. Additional Analyst Notes: - CVE Program Container: References: - https://cdn1.imggmi.com/uploads/2019/10/13/94ef1b084a074ffd9ef63408529aed17-full.png - https://cdn1.imggmi.com/uploads/2019/10/13/e561884443c495286993e186f44dfd1f-full.png - https://cxsecurity.com/issue/WLB-2019100100
CVE ID: CVE-2019-17612 State: PUBLISHED Published: 2019-10-15T22:56:35 Last Updated: 2024-08-05T01:47:13.194Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in 74CMS v5.2.8. There is a SQL Injection generated by the _list method in the Common/Controller/BackendController.class.php file via the index.php?m=Admin&c=Ad&a=category sort parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Ers4tz/vuln/blob/master/74cms_5.2.8_SQLI.md
CVE ID: CVE-2019-17613 State: PUBLISHED Published: 2019-10-15T22:56:23 Last Updated: 2024-08-05T01:47:13.197Z Vendors: n/a Products: n/a Problem Types: n/a Description: qibosoft 7 allows remote code execution because do/jf.php makes eval calls. The attacker can use the Point Introduction Management feature to supply PHP code to be evaluated. Alternatively, the attacker can access admin/index.php?lfj=jfadmin&action=addjf via CSRF, as demonstrated by a payload in the content parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Ers4tz/vuln/blob/master/qibosoft/qibosoft_v7_remote_code_execution.md
CVE ID: CVE-2019-17621 State: PUBLISHED Published: 2019-12-30T16:09:17.000Z Last Updated: 2025-10-21T23:35:54.315Z Vendors: n/a Products: n/a Problem Types: n/a Description: The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to execute system commands as root, by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ftc.gov/system/files/documents/cases/dlink_proposed_order_and_judgment_7-2-19.pdf - https://www.dlink.com/en/security-bulletin - https://suppor
cuments/cases/dlink_proposed_order_and_judgment_7-2-19.pdf - https://www.dlink.com/en/security-bulletin - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10147 - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10146 - https://medium.com/%40s1kr10s/d-link-dir-859-rce-unautenticated-cve-2019-17621-en-d94b47a15104 - https://medium.com/%40s1kr10s/d-link-dir-859-rce-unautenticated-cve-2019-17621-es-fad716629ff9 - http://packetstormsecurity.com/files/156054/D-Link-DIR-859-Unauthenticated-Remote-Command-Execution.html
CVE ID: CVE-2019-17624 State: PUBLISHED Published: 2019-10-16T10:59:54 Last Updated: 2024-08-05T01:47:13.198Z Vendors: n/a Products: n/a Problem Types: n/a Description: "" In X.Org X Server 1.20.4, there is a stack-based buffer overflow in the function XQueryKeymap. For example, by sending ct.c_char 1000 times, an attacker can cause a denial of service (application crash) or possibly have unspecified other impact. Note: It is disputed if the X.Org X Server is involved or if there is a stack overflow. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/47507 - https://www.x.org/releases/individual/xserver/ - http://packetstormsecurity.com/files
ww.exploit-db.com/exploits/47507 - https://www.x.org/releases/individual/xserver/ - http://packetstormsecurity.com/files/154868/X.Org-X-Server-1.20.4-Local-Stack-Overflow.html
CVE ID: CVE-2019-17625 State: PUBLISHED Published: 2019-10-16T11:07:36 Last Updated: 2024-08-05T01:47:13.423Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a stored XSS in Rambox 0.6.9 that can lead to code execution. The XSS is in the name field while adding/editing a service. The problem occurs due to incorrect sanitization of the name field when being processed and stored. This allows a user to craft a payload for Node.js and Electron, such as an exec of OS commands within the onerror attribute of an IMG element. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ramboxapp/community-edition/issues/2418
CVE ID: CVE-2019-17626 State: PUBLISHED Published: 2019-10-16T11:29:38 Last Updated: 2024-08-05T01:47:13.237Z Vendors: n/a Products: n/a Problem Types: n/a Description: ReportLab through 3.5.26 allows remote code execution because of toColor(eval(arg)) in colors.py, as demonstrated by a crafted XML document with '<span color="' followed by arbitrary Python code. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://bitbucket.org/rptlab/reportlab/issues/199/eval-in-colorspy-leads-to-remote-code - https://bitbucket.org/rptlab/reportlab/src/default/CHANGES.md - https://access.redhat.com/errata/RHSA-2020:0197 - https://access.redhat.com/errata/RHSA-202
lab/src/default/CHANGES.md - https://access.redhat.com/errata/RHSA-2020:0197 - https://access.redhat.com/errata/RHSA-2020:0195 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZZPHP2BJSTP4IYCSJRQINP763IHO6ASL/ - https://access.redhat.com/errata/RHSA-2020:0230 - https://access.redhat.com/errata/RHSA-2020:0201 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NSCTOE3DITFICY2XKBYZ5WAF5TSQ52DM/ - http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00002.html - https://usn.ubuntu.com/4273-1/ - https://lists.debian.org/debian-lts-announce/2020/02/msg00019.html - https://www.debian.org/sec
usn.ubuntu.com/4273-1/ - https://lists.debian.org/debian-lts-announce/2020/02/msg00019.html - https://www.debian.org/security/2020/dsa-4663 - https://security.gentoo.org/glsa/202007-35 - https://security.netapp.com/advisory/ntap-20240719-0006/
CVE ID: CVE-2019-17627 State: PUBLISHED Published: 2019-10-16T11:48:53 Last Updated: 2024-08-05T01:47:13.487Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Yale Bluetooth Key application for mobile devices allows unauthorized unlock actions by sniffing Bluetooth Low Energy (BLE) traffic during one authorized unlock action, and then calculating the authentication key via simple computations on the hex digits of a valid authentication request. This affects the Yale ZEN-R lock and unspecified other locks. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PwnMonkeyLab/YaleDoorlockVulnerability/blob/master/HowToDo.md
CVE ID: CVE-2019-17629 State: PUBLISHED Published: 2019-10-16T12:24:10 Last Updated: 2024-08-05T01:47:13.163Z Vendors: n/a Products: n/a Problem Types: n/a Description: CMS Made Simple (CMSMS) 2.2.11 allows stored XSS by an admin via a crafted image filename on the "file manager > upload images" screen. Additional Analyst Notes: - CVE Program Container: References: - https://forum.cmsmadesimple.org/viewforum.php?f=1 - http://dev.cmsmadesimple.org/bug/view/12146
CVE ID: CVE-2019-17630 State: PUBLISHED Published: 2019-10-16T12:23:59 Last Updated: 2024-08-05T01:47:13.194Z Vendors: n/a Products: n/a Problem Types: n/a Description: CMS Made Simple (CMSMS) 2.2.11 allows stored XSS by an admin via a crafted image filename on the "News > Add Article" screen. Additional Analyst Notes: - CVE Program Container: References: - https://forum.cmsmadesimple.org/viewforum.php?f=1 - http://dev.cmsmadesimple.org/bug/view/12149
CVE ID: CVE-2019-17631 State: PUBLISHED Published: 2019-10-17T17:38:26 Last Updated: 2024-08-05T01:47:13.242Z Vendors: The Eclipse Foundation Products: Eclipse OpenJ9 Problem Types: CWE-285 Description: From Eclipse OpenJ9 0.15 to 0.16, access to diagnostic operations such as causing a GC or creating a diagnostic file are permitted without any privilege checks. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.eclipse.org/bugs/show_bug.cgi?id=552129 - https://access.redhat.com/errata/RHSA-2019:4113 - https://access.redhat.com/errata/RHSA-2019:4115 - https://access.redhat.com/errata/RHSA-2020:0006 - https://access.redhat.com/errata/RHSA-2020:0046
CVE ID: CVE-2019-17632 State: PUBLISHED Published: 2019-11-25T21:56:15 Last Updated: 2024-08-05T01:47:13.488Z Vendors: The Eclipse Foundation Products: Eclipse Jetty Problem Types: CWE-79 Description: In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response content (in text/html and text/json Content-Type) does not escape Exception messages in stacktraces included in error output. Additional Analyst Notes: - CVE Program Container: References: - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SAITZ27GKPD2CCNHGT2VBT4VWIBUJJNS/ - https://www.oracle.com/security-alerts/c
-announce%40lists.fedoraproject.org/message/SAITZ27GKPD2CCNHGT2VBT4VWIBUJJNS/ - https://www.oracle.com/security-alerts/cpuoct2020.html - https://bugs.eclipse.org/bugs/show_bug.cgi?id=553443 - https://www.oracle.com/security-alerts/cpuApr2021.html
CVE ID: CVE-2019-17633 State: PUBLISHED Published: 2019-12-19T17:05:12 Last Updated: 2024-08-05T01:47:13.494Z Vendors: The Eclipse Foundation Products: Eclipse Che Problem Types: CWE-352 Description: For Eclipse Che versions 6.16 to 7.3.0, with both authentication and TLS disabled, visiting a malicious web site could trigger the start of an arbitrary Che workspace. Che with no authentication and no TLS is not usually deployed on a public network but is often used for local installations (e.g. on personal laptops). In that case, even if the Che API is not exposed externally, some javascript running in the local browser is able to send requests to it. Additional Analyst Notes: - CVE Program Co
some javascript running in the local browser is able to send requests to it. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.eclipse.org/bugs/show_bug.cgi?id=551596
CVE ID: CVE-2019-17634 State: PUBLISHED Published: 2020-01-17T18:35:13 Last Updated: 2024-08-05T01:47:13.640Z Vendors: The Eclipse Foundation Products: Eclipse Memory Analyzer Problem Types: CWE-79 Description: Eclipse Memory Analyzer version 1.9.1 and earlier is subject to a cross site scripting (XSS) vulnerability when generating an HTML report from a malicious heap dump. The user must chose todownload, open the malicious heap dump and generate an HTML report for the problem to occur. The heap dump could be specially crafted, or could come from a crafted application or from an application processing malicious data. The vulnerability is present whena report is generated and opened from the
om an application processing malicious data. The vulnerability is present whena report is generated and opened from the Memory Analyzer graphical user interface, or when a report generated in batch mode is then opened in Memory Analyzer or by a web browser. The vulnerability could possibly allow code execution on the local system whenthe report is opened in Memory Analyzer. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.eclipse.org/bugs/show_bug.cgi?id=552542