Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-14469 State: PUBLISHED Published: 2019-08-22T17:32:09 Last Updated: 2024-08-05T00:19:41.140Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Nexus Repository Manager before 3.18.0, users with elevated privileges can create stored XSS. Additional Analyst Notes: - CVE Program Container: References: - https://support.sonatype.com/hc/en-us/articles/360033999733-CVE-2019-14469-Nexus-Repository-Manager-3-Cross-Site-Scripting-XSS-2019-07-26
CVE ID: CVE-2019-14470 State: PUBLISHED Published: 2019-09-04T19:24:53 Last Updated: 2024-08-05T00:19:41.084Z Vendors: n/a Products: n/a Problem Types: n/a Description: cosenary Instagram-PHP-API (aka Instagram PHP API V2), as used in the UserPro plugin through 4.9.32 for WordPress, has XSS via the example/success.php error_description parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cosenary/Instagram-PHP-API/commits/master - http://packetstormsecurity.com/files/154206/WordPress-UserPro-4.9.32-Cross-Site-Scripting.html - https://wpvulndb.com/vulnerabilities/9815 - https://www.exploit-db.com/exploits/47304
CVE ID: CVE-2019-14471 State: PUBLISHED Published: 2019-08-01T14:06:40 Last Updated: 2024-08-05T00:19:41.024Z Vendors: n/a Products: n/a Problem Types: n/a Description: TestLink 1.9.19 has XSS via the error.php message parameter. Additional Analyst Notes: - CVE Program Container: References: - https://code610.blogspot.com/2019/07/xss-in-testlink-1919.html
CVE ID: CVE-2019-14472 State: PUBLISHED Published: 2019-08-01T14:06:50 Last Updated: 2024-08-05T00:19:41.175Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zurmo 3.2.7-2 has XSS via the app/index.php/zurmo/default PATH_INFO. Additional Analyst Notes: - CVE Program Container: References: - https://code610.blogspot.com/2019/07/xss-in-zurmo-crm.html
CVE ID: CVE-2019-14473 State: PUBLISHED Published: 2019-08-06T18:03:10 Last Updated: 2024-08-05T00:19:41.317Z Vendors: n/a Products: n/a Problem Types: n/a Description: eQ-3 Homematic CCU2 and CCU3 use session IDs for authentication but lack authorization checks. Consequently, a valid guest level or user level account can create a new admin level account, read the service messages, clear the system protocol or modify/delete internal programs, etc. pp. Additional Analyst Notes: - CVE Program Container: References: - https://psytester.github.io/CVE-2019-14473
CVE ID: CVE-2019-14474 State: PUBLISHED Published: 2019-08-07T17:12:43 Last Updated: 2024-08-05T00:19:41.267Z Vendors: n/a Products: n/a Problem Types: n/a Description: eQ-3 Homematic CCU3 3.47.15 and prior has Improper Input Validation in function 'Call()' of ReGa core logic process, resulting in the ability to start a Denial of Service. Due to Improper Authorization an attacker can obtain a session ID from CVE-2019-9583 or a valid guest/user/admin account can start this attack too. Additional Analyst Notes: - CVE Program Container: References: - https://psytester.github.io/CVE-2019-14474
CVE ID: CVE-2019-14475 State: PUBLISHED Published: 2019-08-05T19:27:50 Last Updated: 2024-08-05T00:19:41.137Z Vendors: n/a Products: n/a Problem Types: n/a Description: eQ-3 Homematic CCU2 2.47.15 and prior and CCU3 3.47.15 and prior use session IDs for authentication but lack authorization checks. An attacker can obtain a session ID from CVE-2019-9583, resulting in the ability to read the service messages, clear the system protocol, create a new user in the system, or modify/delete internal programs. Additional Analyst Notes: - CVE Program Container: References: - https://psytester.github.io/CVE-2019-14475
CVE ID: CVE-2019-14476 State: PUBLISHED Published: 2020-12-16T16:50:47 Last Updated: 2024-08-05T00:19:41.050Z Vendors: n/a Products: n/a Problem Types: n/a Description: AdRem NetCrunch 10.6.0.4587 has a Server-Side Request Forgery (SSRF) vulnerability in the NetCrunch server. Every user can trick the server into performing SMB requests to other systems. Additional Analyst Notes: - CVE Program Container: References: - https://www.adremsoft.com/support/ - https://compass-security.com/fileadmin/Research/Advisories/2020-10_CSNC-2019-011_AdRem_NetCrunch_Server-Side_Request_Forgery_SSRF.txt
CVE ID: CVE-2019-14477 State: PUBLISHED Published: 2020-12-16T15:38:50 Last Updated: 2024-08-05T00:19:41.122Z Vendors: n/a Products: n/a Problem Types: n/a Description: AdRem NetCrunch 10.6.0.4587 has Improper Credential Storage since the internal user database is readable by low-privileged users and passwords in the database are weakly encoded or encrypted. Additional Analyst Notes: - CVE Program Container: References: - https://www.adremsoft.com/support/ - https://compass-security.com/fileadmin/Research/Advisories/2020-11_CSNC-2019-012_AdRem_NetCrunch_Improper_Credential_Storage.txt
CVE ID: CVE-2019-14478 State: PUBLISHED Published: 2020-12-16T17:01:52 Last Updated: 2024-08-05T00:19:41.076Z Vendors: n/a Products: n/a Problem Types: n/a Description: AdRem NetCrunch 10.6.0.4587 has a stored Cross-Site Scripting (XSS) vulnerability in the NetCrunch web client. The user's input data is not properly encoded when being echoed back to the user. This data can be interpreted as executable code by the browser and allows an attacker to execute JavaScript code in the context of the user's browser if the victim opens or searches for a node whose "Display Name" contains an XSS payload. Additional Analyst Notes: - CVE Program Container: References: - https://www.adremsoft.com/support/
ains an XSS payload. Additional Analyst Notes: - CVE Program Container: References: - https://www.adremsoft.com/support/ - https://compass-security.com/fileadmin/Research/Advisories/2020-12_CSNC-2019-013_AdRem_NetCrunch_Cross-Site_Scripting_XSS.txt
CVE ID: CVE-2019-14479 State: PUBLISHED Published: 2020-12-16T16:39:42 Last Updated: 2024-08-05T00:19:41.131Z Vendors: n/a Products: n/a Problem Types: n/a Description: AdRem NetCrunch 10.6.0.4587 allows Remote Code Execution. In the NetCrunch web client, a read-only administrator can execute arbitrary code on the server running the NetCrunch server software. Additional Analyst Notes: - CVE Program Container: References: - https://www.adremsoft.com/support/ - https://compass-security.com/fileadmin/Research/Advisories/2020-13_CSNC-2019-014_AdRem_NetCrunch_Remote_Code_Execution.txt
CVE ID: CVE-2019-14480 State: PUBLISHED Published: 2020-12-16T15:41:25 Last Updated: 2024-08-05T00:19:41.130Z Vendors: n/a Products: n/a Problem Types: n/a Description: AdRem NetCrunch 10.6.0.4587 has an Improper Session Handling vulnerability in the NetCrunch web client, which can lead to an authentication bypass or escalation of privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.adremsoft.com/support/ - https://compass-security.com/fileadmin/Research/Advisories/2020-14_CSNC-2019-015_AdRem_NetCrunch_Improper_Session_Handling.txt
CVE ID: CVE-2019-14481 State: PUBLISHED Published: 2020-12-16T16:55:36 Last Updated: 2024-08-05T00:19:41.190Z Vendors: n/a Products: n/a Problem Types: n/a Description: AdRem NetCrunch 10.6.0.4587 has a Cross-Site Request Forgery (CSRF) vulnerability in the NetCrunch web client. Successful exploitation requires a logged-in user to open a malicious page and leads to account takeover. Additional Analyst Notes: - CVE Program Container: References: - https://www.adremsoft.com/support/ - https://compass-security.com/fileadmin/Research/Advisories/2020-15_CSNC-2019-016_AdRem_NetCrunch_Cross-Site_Request_Forgery_CSRF.txt
CVE ID: CVE-2019-14482 State: PUBLISHED Published: 2020-12-16T15:47:15 Last Updated: 2024-08-05T00:19:41.142Z Vendors: n/a Products: n/a Problem Types: n/a Description: AdRem NetCrunch 10.6.0.4587 has a hardcoded SSL private key vulnerability in the NetCrunch web client. The same hardcoded SSL private key is used across different customers' installations when no other SSL certificate is installed, which allows remote attackers to defeat cryptographic protection mechanisms by leveraging knowledge of this key from another installation. Additional Analyst Notes: - CVE Program Container: References: - https://www.adremsoft.com/support/ - https://compass-security.com/fileadmin/Research/Advisories
Container: References: - https://www.adremsoft.com/support/ - https://compass-security.com/fileadmin/Research/Advisories/2020-16_CSNC-2019-017_AdRem_NetCrunch_Hardcoded_SSL_Private_Key.txt
CVE ID: CVE-2019-14483 State: PUBLISHED Published: 2020-12-16T15:44:01 Last Updated: 2024-08-05T00:19:41.193Z Vendors: n/a Products: n/a Problem Types: n/a Description: AdRem NetCrunch 10.6.0.4587 allows Credentials Disclosure. Every user can read the BSD, Linux, MacOS and Solaris private keys, private keys' passwords, and root passwords stored in the credential manager. Every administrator can read the ESX and Windows passwords stored in the credential manager. Additional Analyst Notes: - CVE Program Container: References: - https://www.adremsoft.com/support/ - https://compass-security.com/fileadmin/Research/Advisories/2020-17_CSNC-2019-018_AdRem_NetCrunch_Credentials_Disclosure.txt
CVE ID: CVE-2019-14486 State: PUBLISHED Published: 2019-08-01T15:22:08 Last Updated: 2024-08-05T00:19:41.129Z Vendors: n/a Products: n/a Problem Types: n/a Description: GnuCOBOL 2.2 has a buffer overflow in cb_evaluate_expr in cobc/field.c via crafted COBOL source code. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/open-cobol/bugs/582/
CVE ID: CVE-2019-14491 State: PUBLISHED Published: 2019-08-01T16:04:44 Last Updated: 2024-08-05T00:19:41.013Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in OpenCV before 3.4.7 and 4.x before 4.1.1. There is an out of bounds read in the function cv::predictOrdered<cv::HaarEvaluator> in modules/objdetect/src/cascadedetect.hpp, which leads to denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/opencv/opencv/issues/15125 - https://github.com/opencv/opencv/compare/33b765d...4a7ca5a - https://github.com/opencv/opencv/compare/371bba8...ddbd10c - https://lists.fedoraproject.org/archives/list/package-announce%4
://github.com/opencv/opencv/compare/371bba8...ddbd10c - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HPFLN6QAX6SUA4XR4NMKKXX26H3TYCVQ/ - http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00025.html
CVE ID: CVE-2019-14492 State: PUBLISHED Published: 2019-08-01T16:04:51 Last Updated: 2024-08-05T00:19:41.138Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in OpenCV before 3.4.7 and 4.x before 4.1.1. There is an out of bounds read/write in the function HaarEvaluator::OptFeature::calc in modules/objdetect/src/cascadedetect.hpp, which leads to denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/opencv/opencv/compare/33b765d...4a7ca5a - https://github.com/opencv/opencv/compare/371bba8...ddbd10c - https://github.com/opencv/opencv/issues/15124 - http://lists.opensuse.org/opensuse-security-announce/2019-12/msg
bd10c - https://github.com/opencv/opencv/issues/15124 - http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00025.html
CVE ID: CVE-2019-14493 State: PUBLISHED Published: 2019-08-01T16:05:00 Last Updated: 2024-08-05T00:19:41.322Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in OpenCV before 4.1.1. There is a NULL pointer dereference in the function cv::XMLParser::parse at modules/core/src/persistence.cpp. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/opencv/opencv/compare/371bba8...ddbd10c - https://github.com/opencv/opencv/issues/15127 - https://lists.debian.org/debian-lts-announce/2021/10/msg00028.html
CVE ID: CVE-2019-14494 State: PUBLISHED Published: 2019-08-01T16:05:09 Last Updated: 2024-08-05T00:19:41.105Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Poppler through 0.78.0. There is a divide-by-zero error in the function SplashOutputDev::tilingPatternFill at SplashOutputDev.cc. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.freedesktop.org/poppler/poppler/issues/802 - https://gitlab.freedesktop.org/poppler/poppler/merge_requests/317 - https://usn.ubuntu.com/4091-1/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AHYAM32PALHQXL3O4DKIJ3EJB6AKBOVC/ - https://lists.f
org/archives/list/package-announce%40lists.fedoraproject.org/message/AHYAM32PALHQXL3O4DKIJ3EJB6AKBOVC/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DLAQBLBIIL3A5XZQYR4MG3Z4LIPIC42P/ - https://lists.debian.org/debian-lts-announce/2020/11/msg00014.html - https://lists.debian.org/debian-lts-announce/2022/09/msg00030.html
CVE ID: CVE-2019-14495 State: PUBLISHED Published: 2019-08-01T16:48:14 Last Updated: 2024-08-05T00:19:41.129Z Severity: MEDIUM (CVSS 5.8 CVSS:3.0/AC:H/AV:N/A:H/C:N/I:N/PR:H/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: webadmin.c in 3proxy before 0.8.13 has an out-of-bounds write in the admin interface. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/z3APA3A/3proxy/releases/tag/0.8.13 - https://github.com/z3APA3A/3proxy/compare/0.8.12...0.8.13 - https://github.com/z3APA3A/3proxy/commit/3b67dc844789dc0f00e934270c7b349bcb547865
CVE ID: CVE-2019-14496 State: PUBLISHED Published: 2019-08-01T17:28:16 Last Updated: 2024-08-05T00:19:41.188Z Vendors: n/a Products: n/a Problem Types: n/a Description: LoaderXM::load in LoaderXM.cpp in milkyplay in MilkyTracker 1.02.00 has a stack-based buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/milkytracker/MilkyTracker/issues/183 - https://lists.debian.org/debian-lts-announce/2019/10/msg00029.html - https://lists.debian.org/debian-lts-announce/2020/07/msg00023.html - https://usn.ubuntu.com/4499-1/
CVE ID: CVE-2019-14497 State: PUBLISHED Published: 2019-08-01T17:28:27 Last Updated: 2024-08-05T00:19:41.135Z Vendors: n/a Products: n/a Problem Types: n/a Description: ModuleEditor::convertInstrument in tracker/ModuleEditor.cpp in MilkyTracker 1.02.00 has a heap-based buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/milkytracker/MilkyTracker/issues/182 - https://lists.debian.org/debian-lts-announce/2019/10/msg00029.html - https://lists.debian.org/debian-lts-announce/2020/07/msg00023.html - https://usn.ubuntu.com/4499-1/
CVE ID: CVE-2019-14498 State: PUBLISHED Published: 2019-08-29T17:35:50 Last Updated: 2024-08-05T00:19:41.193Z Vendors: n/a Products: n/a Problem Types: n/a Description: A divide-by-zero error exists in the Control function of demux/caf.c in VideoLAN VLC media player 3.0.7.1. As a result, an FPE can be triggered via a crafted CAF file. Additional Analyst Notes: - CVE Program Container: References: - http://git.videolan.org/?p=vlc.git&a=search&h=refs/heads/master&st=commit&s=cve-2019 - https://www.debian.org/security/2019/dsa-4504 - https://seclists.org/bugtraq/2019/Aug/36 - https://www.videolan.org/security/sb-vlc308.html - https://security.gentoo.org/glsa/201909-02 - https://usn.ubuntu.com/4
https://www.videolan.org/security/sb-vlc308.html - https://security.gentoo.org/glsa/201909-02 - https://usn.ubuntu.com/4131-1/ - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00036.html - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00046.html
CVE ID: CVE-2019-14499 State: REJECTED Published: 2020-03-06T23:50:25 Last Updated: 2020-03-06T23:50:25 Description: No description available.
CVE ID: CVE-2019-14500 State: REJECTED Published: 2020-03-06T23:50:25 Last Updated: 2020-03-06T23:50:25 Description: No description available.
CVE ID: CVE-2019-14501 State: REJECTED Published: 2020-03-06T23:50:26 Last Updated: 2020-03-06T23:50:26 Description: No description available.
CVE ID: CVE-2019-14502 State: REJECTED Published: 2020-03-06T23:50:26 Last Updated: 2020-03-06T23:50:26 Description: No description available.
CVE ID: CVE-2019-14503 State: REJECTED Published: 2020-03-06T23:50:27 Last Updated: 2020-03-06T23:50:27 Description: No description available.
CVE ID: CVE-2019-14504 State: REJECTED Published: 2020-03-06T23:50:27 Last Updated: 2020-03-06T23:50:27 Description: No description available.
CVE ID: CVE-2019-14505 State: REJECTED Published: 2020-03-06T23:50:27 Last Updated: 2020-03-06T23:50:27 Description: No description available.
CVE ID: CVE-2019-14506 State: REJECTED Published: 2020-03-06T23:50:28 Last Updated: 2020-03-06T23:50:28 Description: No description available.
CVE ID: CVE-2019-14507 State: REJECTED Published: 2020-03-06T23:50:28 Last Updated: 2020-03-06T23:50:28 Description: No description available.
CVE ID: CVE-2019-14508 State: REJECTED Published: 2020-03-06T23:50:29 Last Updated: 2020-03-06T23:50:29 Description: No description available.
CVE ID: CVE-2019-14510 State: PUBLISHED Published: 2019-10-11T11:44:18 Last Updated: 2024-08-05T00:19:41.084Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Kaseya VSA RMM through 9.5.0.22. When using the default configuration, the LAN Cache feature creates a local account FSAdminxxxxxxxxx (e.g., FSAdmin123456789) on the server that hosts the LAN Cache and all clients that are assigned to a LAN Cache. This account is placed into the local Administrators group of all clients assigned to the LAN Cache. When the assigned client is a Domain Controller, the FSAdminxxxxxxxxx account is created as a domain account and automatically added as a member of the dom
n Controller, the FSAdminxxxxxxxxx account is created as a domain account and automatically added as a member of the domain BUILTIN\Administrators group. Using the well known Pass-the-Hash techniques, an attacker can use the same FSAdminxxxxxxxxx hash from any LAN Cache client and pass this to a Domain Controller, providing administrative rights to the attacker on any Domain Controller. (Local account Pass-the-Hash mitigations do not protect domain accounts.) Additional Analyst Notes: - CVE Program Container: References: - https://www.kaseya.com/products/vsa/ - http://community.kaseya.com/xsp/f/355.aspx - https://lockstepgroup.com/blog/abusing-the-kaseya-lan-cache-fsadmin/ - https://lockstep
nity.kaseya.com/xsp/f/355.aspx - https://lockstepgroup.com/blog/abusing-the-kaseya-lan-cache-fsadmin/ - https://lockstepgroup.com/blog/cve-2019-14510-abusing-the-kaseya-lan-cache-fsadmin-red-team-edition/ - http://community.kaseya.com/xsp/f/355/t/24675.aspx
CVE ID: CVE-2019-14511 State: PUBLISHED Published: 2019-08-22T12:26:41 Last Updated: 2024-08-05T00:19:41.184Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sphinx Technologies Sphinx 3.1.1 by default has no authentication and listens on 0.0.0.0, making it exposed to the internet (unless filtered by a firewall or reconfigured to listen to 127.0.0.1 only). Additional Analyst Notes: - CVE Program Container: References: - http://sphinxsearch.com/docs/sphinx3.html#getting-started-on-linux-and-macos - https://sphinxsearch.com/blog/ - https://blog.wirhabenstil.de/2019/08/19/sphinxsearch-0-0-0-09306-cve-2019-14511/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists
/08/19/sphinxsearch-0-0-0-09306-cve-2019-14511/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YSLPW44RWIGHU5AG3P4U2HPSD3UBG4GJ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XD25JJJVM7FFXAO2L3ZG2KXQ6UMFBIA4/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3FPPNZZMWTZOMFGFETMET6YKIH2DQDKS/
CVE ID: CVE-2019-14512 State: PUBLISHED Published: 2020-03-16T14:43:38 Last Updated: 2024-08-05T00:19:41.219Z Vendors: n/a Products: n/a Problem Types: n/a Description: LimeSurvey 3.17.7+190627 has XSS via Boxes in application/extensions/PanelBoxWidget/views/box.php or a label title in application/views/admin/labels/labelview_view.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.limesurvey.org/ - https://www.linkedin.com/in/michelecisternino/ - https://github.com/LimeSurvey/LimeSurvey/commit/f2566f6978a77e3f0870079c45cda1c065a58a73 - https://github.com/LimeSurvey/LimeSurvey/commit/0b7391dff91b326284ca3fc5188b768b5d522d88
CVE ID: CVE-2019-14513 State: PUBLISHED Published: 2019-08-01T20:47:48 Last Updated: 2024-08-05T00:19:41.201Z Vendors: n/a Products: n/a Problem Types: n/a Description: Improper bounds checking in Dnsmasq before 2.76 allows an attacker controlled DNS server to send large DNS packets that result in a read operation beyond the buffer allocated for the packet, a different vulnerability than CVE-2017-14491. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Slovejoy/dnsmasq-pre2.76 - https://lists.debian.org/debian-lts-announce/2019/09/msg00013.html
CVE ID: CVE-2019-14514 State: PUBLISHED Published: 2020-02-10T21:52:56 Last Updated: 2024-08-05T00:19:41.179Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Microvirt MEmu all versions prior to 7.0.2. A guest Android operating system inside the MEmu emulator contains a /system/bin/systemd binary that is run with root privileges on startup (this is unrelated to Red Hat's systemd init program, and is a closed-source proprietary tool that seems to be developed by Microvirt). This program opens TCP port 21509, presumably to receive installation-related commands from the host OS. Because everything after the installer:uninstall command is concatenated direct
ation-related commands from the host OS. Because everything after the installer:uninstall command is concatenated directly into a system() call, it is possible to execute arbitrary commands by supplying shell metacharacters. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/seqred-s-a/cve-2019-14514
CVE ID: CVE-2019-14516 State: PUBLISHED Published: 2019-08-13T13:36:32 Last Updated: 2024-08-05T00:19:41.361Z Vendors: n/a Products: n/a Problem Types: n/a Description: The mAadhaar application 1.2.7 for Android lacks SSL Certificate Validation, leading to man-in-the-middle attacks against requests for FAQs or Help. Additional Analyst Notes: - CVE Program Container: References: - https://play.google.com/store/apps/details?id=in.gov.uidai.mAadhaarPlus&hl=en_US - https://github.com/fs0c131y/ConPresentations/blob/master/AppSecVillageDefcon27.mAadhaar.pdf
CVE ID: CVE-2019-14517 State: PUBLISHED Published: 2019-08-01T22:04:02 Last Updated: 2024-08-05T00:19:41.193Z Vendors: n/a Products: n/a Problem Types: n/a Description: pandao Editor.md 1.5.0 allows XSS via the Javas&#99;ript: string. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pandao/editor.md/issues/709
CVE ID: CVE-2019-14518 State: PUBLISHED Published: 2019-08-15T15:51:30 Last Updated: 2024-08-05T00:19:41.169Z Vendors: n/a Products: n/a Problem Types: n/a Description: Evolution CMS 2.0.x allows XSS via a description and new category location in a template. NOTE: the vendor states that the behavior is consistent with the "access policy in the administration panel. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/evolution-cms/evolution/issues/1041 - https://github.com/evolution-cms/evolution/issues/1042 - https://github.com/evolution-cms/evolution/issues/1043
CVE ID: CVE-2019-14521 State: PUBLISHED Published: 2019-08-05T11:30:56 Last Updated: 2024-08-05T00:19:41.163Z Vendors: n/a Products: n/a Problem Types: n/a Description: The api/admin/logoupload Logo File upload feature in EMCA Energy Logserver 6.1.2 allows attackers to send any kind of file to any location on the server via path traversal in the filename parameter. Additional Analyst Notes: - CVE Program Container: References: - https://energy-log-server-6x.readthedocs.io/en/latest/CHANGELOG.html - https://energylogserver.pl/en/ - https://github.com/emca-it/Energy-Log-Server-6.x/commits/master - https://gist.github.com/ahpaleus/effb46d4a9d9c2b9a452c98f64ddc2c7