Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-16137 State: PUBLISHED Published: 2019-09-09T11:45:39 Last Updated: 2024-08-05T01:10:41.177Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the spin crate before 0.5.2 for Rust, when RwLock is used. Because memory ordering is mishandled, two writers can acquire the lock at the same time, violating mutual exclusion. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2019-0013.html
CVE ID: CVE-2019-16138 State: PUBLISHED Published: 2019-09-09T11:49:30 Last Updated: 2024-08-05T01:10:41.367Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the image crate before 0.21.3 for Rust, affecting the HDR image format decoder. Vec::set_len is called on an uninitialized vector, leading to a use-after-free and arbitrary code execution. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2019-0014.html - https://github.com/image-rs/image/pull/985
CVE ID: CVE-2019-16139 State: PUBLISHED Published: 2019-09-09T11:50:34 Last Updated: 2024-08-05T01:10:41.246Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the compact_arena crate before 0.4.0 for Rust. Generativity is mishandled, leading to an out-of-bounds write or read. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2019-0015.html - https://github.com/llogiq/compact_arena/issues/22
CVE ID: CVE-2019-16140 State: PUBLISHED Published: 2019-09-09T00:00:00 Last Updated: 2024-08-05T01:10:41.116Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the chttp crate before 0.1.3 for Rust. There is a use-after-free during buffer conversion. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2019-0016.html - https://github.com/sagebind/isahc/issues/2
CVE ID: CVE-2019-16141 State: PUBLISHED Published: 2019-09-09T11:55:10 Last Updated: 2024-08-05T01:10:40.974Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the once_cell crate before 1.0.1 for Rust. There is a panic during initialization of Lazy. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2019-0017.html - https://github.com/matklad/once_cell/issues/46
CVE ID: CVE-2019-16142 State: PUBLISHED Published: 2019-09-09T11:56:32 Last Updated: 2024-08-05T01:10:41.102Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the renderdoc crate before 0.5.0 for Rust. Multiple exposed methods take self by immutable reference, which is incompatible with a multi-threaded application. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2019-0018.html - https://github.com/ebkalderon/renderdoc-rs/pull/32
CVE ID: CVE-2019-16143 State: PUBLISHED Published: 2019-09-09T11:58:51 Last Updated: 2024-08-05T01:10:41.237Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the blake2 crate before 0.8.1 for Rust. The BLAKE2b and BLAKE2s algorithms, when used with HMAC, produce incorrect results because the block sizes are half of the required sizes. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2019-0019.html
CVE ID: CVE-2019-16144 State: PUBLISHED Published: 2019-09-09T12:00:58 Last Updated: 2024-08-05T01:10:41.270Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the generator crate before 0.6.18 for Rust. Uninitialized memory is used by Scope, done, and yield_ during API calls. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2019-0020.html - https://github.com/Xudong-Huang/generator-rs/issues/9
CVE ID: CVE-2019-16145 State: PUBLISHED Published: 2019-09-09T20:46:41 Last Updated: 2024-08-05T01:10:41.175Z Vendors: n/a Products: n/a Problem Types: n/a Description: The breadcrumbs contributed module through 0.2.0 for Padrino Framework allows XSS via a caption. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/padrino/padrino-contrib/pull/35
CVE ID: CVE-2019-16146 State: PUBLISHED Published: 2019-09-09T12:11:12 Last Updated: 2024-08-05T01:10:41.126Z Vendors: n/a Products: n/a Problem Types: n/a Description: Gophish through 0.8.0 allows XSS via a username. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gophish/gophish/pull/1547
CVE ID: CVE-2019-16147 State: PUBLISHED Published: 2019-09-09T20:45:18 Last Updated: 2024-08-05T01:10:40.970Z Vendors: n/a Products: n/a Problem Types: n/a Description: Liferay Portal through 7.2.0 GA1 allows XSS via a journal article title to journal_article/page.jsp in journal/journal-taglib. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/liferay/liferay-portal/commit/7e063aed70f947a92bb43a4471e0c4e650fe8f7f
CVE ID: CVE-2019-16148 State: PUBLISHED Published: 2019-09-09T12:20:39 Last Updated: 2024-08-05T01:10:41.267Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sakai through 12.6 allows XSS via a chat user name. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sakaiproject/sakai/pull/6971
CVE ID: CVE-2019-16149 State: PUBLISHED Published: 2025-03-28T09:07:30.099Z Last Updated: 2025-03-28T14:30:50.994Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L/E:F/RL:X/RC:X) Vendors: Fortinet Products: FortiClientEMS Problem Types: CWE-79 Description: An Improper Neutralization of Input During Web Page Generation in FortiClientEMS version 6.2.0 may allow a remote attacker to execute unauthorized code by injecting malicious payload in the user profile of a FortiClient instance being managed by the vulnerable system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-19-072
CVE ID: CVE-2019-16150 State: PUBLISHED Published: 2020-06-04T12:27:29 Last Updated: 2024-10-25T14:01:30.678Z Vendors: n/a Products: Fortinet FortiClient for Windows Problem Types: Information Disclosure Description: Use of a hard-coded cryptographic key to encrypt security sensitive data in local storage and configuration in FortiClient for Windows prior to 6.4.0 may allow an attacker with access to the local storage or the configuration backup file to decrypt the sensitive data via knowledge of the hard-coded key. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-19-194
CVE ID: CVE-2019-16151 State: PUBLISHED Published: 2025-03-21T16:02:01.913Z Last Updated: 2025-03-21T16:22:17.554Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N/E:U/RL:X/RC:X) Vendors: Fortinet Products: FortiOS Problem Types: CWE-79 Description: An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiOS 6.4.1 and below, 6.2.9 and below may allow a remote unauthenticated attacker to either redirect users to malicious websites via a crafted "Host" header or to execute JavaScript code in the victim's browser context. This happens when the FortiGate has web filtering and category override enabled/configured. Additional Analyst Note
ext. This happens when the FortiGate has web filtering and category override enabled/configured. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-19-301
CVE ID: CVE-2019-16152 State: PUBLISHED Published: 2020-02-06T15:27:36 Last Updated: 2024-10-25T14:03:38.520Z Vendors: Fortinet Products: Fortinet FortiClientLinux Problem Types: Escalation of privilege Description: A Denial of service (DoS) vulnerability in FortiClient for Linux 6.2.1 and below may allow an user with low privilege to cause FortiClient processes running under root privilege crashes via sending specially crafted IPC client requests to the fctsched process due the nanomsg not been correctly validated. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-19-238 - https://danishcyberdefence.dk/blog/forticlie
ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-19-238 - https://danishcyberdefence.dk/blog/forticlient_linux
CVE ID: CVE-2019-16153 State: PUBLISHED Published: 2020-01-23T16:39:59 Last Updated: 2024-10-25T14:27:30.098Z Vendors: Fortinet Products: Fortinet FortiSIEM Problem Types: Information disclosure Description: A hard-coded password vulnerability in the Fortinet FortiSIEM database component version 5.2.5 and below may allow attackers to access the device database via the use of static credentials. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-19-195
CVE ID: CVE-2019-16154 State: PUBLISHED Published: 2020-01-07T18:22:21 Last Updated: 2024-10-25T14:04:34.182Z Vendors: Fortinet Products: FortiAuthenticator WEB UI Problem Types: Execute unauthorized code or commands Description: An improper neutralization of input during web page generation in FortiAuthenticator WEB UI 6.0.0 may allow an unauthenticated user to perform a cross-site scripting attack (XSS) via a parameter of the logon page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-19-104
CVE ID: CVE-2019-16155 State: PUBLISHED Published: 2020-02-07T14:47:28 Last Updated: 2024-10-25T14:03:28.477Z Vendors: Fortinet Products: Fortinet FortiClientLinux Problem Types: Escalation of privilege Description: A privilege escalation vulnerability in FortiClient for Linux 6.2.1 and below may allow a user with low privilege to overwrite system files as root with arbitrary content through system backup file via specially crafted "BackupConfig" type IPC client requests to the fctsched process. Further more, FortiClient for Linux 6.2.2 and below allow low privilege user write the system backup file under root privilege through GUI thus can cause root system file overwrite. Additional Analys
ite the system backup file under root privilege through GUI thus can cause root system file overwrite. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-19-238 - https://danishcyberdefence.dk/blog/forticlient_linux
CVE ID: CVE-2019-16156 State: PUBLISHED Published: 2020-03-12T21:15:34 Last Updated: 2024-10-25T14:03:17.298Z Vendors: Fortinet Products: Fortinet FortiWeb Problem Types: Execute unauthorized code or commands Description: An Improper Neutralization of Input vulnerability in the Anomaly Detection Parameter Name in Fortinet FortiWeb 6.0.5, 6.2.0, and 6.1.1 may allow a remote unauthenticated attacker to perform a Cross Site Scripting attack (XSS). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-19-265
CVE ID: CVE-2019-16157 State: PUBLISHED Published: 2020-03-13T15:02:45 Last Updated: 2024-10-25T14:02:54.064Z Vendors: Fortinet Products: Fortinet FortiWeb Problem Types: Information disclosure Description: An information exposure vulnerability in Fortinet FortiWeb 6.2.0 CLI and earlier may allow an authenticated user to view sensitive information being logged via diagnose debug commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-19-269
CVE ID: CVE-2019-16159 State: PUBLISHED Published: 2019-09-09T14:34:57 Last Updated: 2024-08-05T01:10:41.269Z Vendors: n/a Products: n/a Problem Types: n/a Description: BIRD Internet Routing Daemon 1.6.x through 1.6.7 and 2.x through 2.0.5 has a stack-based buffer overflow. The BGP daemon's support for RFC 8203 administrative shutdown communication messages included an incorrect logical expression when checking the validity of an input message. Sending a shutdown communication with a sufficient message length causes a four-byte overflow to occur while processing the message, where two of the overflow bytes are attacker-controlled and two are fixed. Additional Analyst Notes: - CVE Program Con
, where two of the overflow bytes are attacker-controlled and two are fixed. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.labs.nic.cz/labs/bird/commit/8388f5a7e14108a1458fea35bfbb5a453e2c563c - https://gitlab.labs.nic.cz/labs/bird/commit/1657c41c96b3c07d9265b07dd4912033ead4124b - http://trubka.network.cz/pipermail/bird-users/2019-September/013718.html - http://trubka.network.cz/pipermail/bird-users/2019-September/013720.html - http://trubka.network.cz/pipermail/bird-users/2019-September/013722.html - http://bird.network.cz - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4F23NNAPXX65MGJQBPPTVGRV3T4XCKBV/ - h
fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4F23NNAPXX65MGJQBPPTVGRV3T4XCKBV/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MCVNQJBZYGGNAJNGOFEBE3IAJME2QIZB/ - https://seclists.org/bugtraq/2019/Sep/34 - https://www.debian.org/security/2019/dsa-4528 - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00063.html - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00065.html
CVE ID: CVE-2019-16160 State: PUBLISHED Published: 2020-10-07T15:07:39 Last Updated: 2024-08-05T01:10:41.178Z Vendors: n/a Products: n/a Problem Types: n/a Description: An integer underflow in the SMB server of MikroTik RouterOS before 6.45.5 allows remote unauthenticated attackers to crash the service. Additional Analyst Notes: - CVE Program Container: References: - https://mikrotik.com - https://forum.mikrotik.com/viewtopic.php?t=151603 - https://gist.github.com/thebabush/3c71fc5001f8865e3ad579e80680ce24
CVE ID: CVE-2019-16161 State: PUBLISHED Published: 2019-09-09T15:38:30 Last Updated: 2024-08-05T01:10:41.296Z Vendors: n/a Products: n/a Problem Types: n/a Description: Onigmo through 6.2.0 has a NULL pointer dereference in onig_error_code_to_str because of fetch_token in regparse.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/k-takata/Onigmo/issues/132 - https://github.com/k-takata/Onigmo/commit/9827d5a0298ee766f6041db9c0080166ff6cdce8
CVE ID: CVE-2019-16162 State: PUBLISHED Published: 2019-09-09T15:38:21 Last Updated: 2024-08-05T01:10:41.427Z Vendors: n/a Products: n/a Problem Types: n/a Description: Onigmo through 6.2.0 has an out-of-bounds read in parse_char_class because of missing codepoint validation in regenc.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/k-takata/Onigmo/issues/139
CVE ID: CVE-2019-16163 State: PUBLISHED Published: 2019-09-09T15:38:09 Last Updated: 2024-08-05T01:10:41.294Z Vendors: n/a Products: n/a Problem Types: n/a Description: Oniguruma before 6.9.3 allows Stack Exhaustion in regcomp.c because of recursion in regparse.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kkos/oniguruma/issues/147 - https://github.com/kkos/oniguruma/commit/4097828d7cc87589864fecf452f2cd46c5f37180 - https://github.com/kkos/oniguruma/compare/v6.9.2...v6.9.3 - https://lists.debian.org/debian-lts-announce/2019/09/msg00010.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NWOWZZNFSAWM3
10.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NWOWZZNFSAWM3BUTQNAE3PD44A6JU4KE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZW47MSFZ6WYOAOFXHBDGU4LYACFRKC2Y/ - https://usn.ubuntu.com/4460-1/
CVE ID: CVE-2019-16164 State: PUBLISHED Published: 2019-09-09T15:37:59 Last Updated: 2024-08-05T01:10:41.264Z Vendors: n/a Products: n/a Problem Types: n/a Description: MyHTML through 4.0.5 has a NULL pointer dereference in myhtml_tree_node_remove in tree.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/lexborisov/myhtml/issues/175
CVE ID: CVE-2019-16165 State: PUBLISHED Published: 2019-09-09T15:37:49 Last Updated: 2024-08-05T01:10:41.621Z Vendors: n/a Products: n/a Problem Types: n/a Description: GNU cflow through 1.6 has a use-after-free in the reference function in parser.c. Additional Analyst Notes: - CVE Program Container: References: - https://lists.gnu.org/archive/html/bug-cflow/2019-04/msg00001.html
CVE ID: CVE-2019-16166 State: PUBLISHED Published: 2019-09-09T15:37:41 Last Updated: 2024-08-05T01:10:41.543Z Vendors: n/a Products: n/a Problem Types: n/a Description: GNU cflow through 1.6 has a heap-based buffer over-read in the nexttoken function in parser.c. Additional Analyst Notes: - CVE Program Container: References: - https://lists.gnu.org/archive/html/bug-cflow/2019-04/msg00000.html
CVE ID: CVE-2019-16167 State: PUBLISHED Published: 2019-09-09T00:00:00 Last Updated: 2024-08-05T01:10:41.312Z Vendors: n/a Products: n/a Problem Types: n/a Description: sysstat before 12.1.6 has memory corruption due to an Integer Overflow in remap_struct() in sa_common.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sysstat/sysstat/issues/230 - https://github.com/sysstat/sysstat/compare/v12.1.5...v12.1.6 - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00067.html - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00068.html - https://usn.ubuntu.com/4242-1/ - https://lists.fedoraproject.org/archives/list/package-announce%
2019-10/msg00068.html - https://usn.ubuntu.com/4242-1/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RVSMKUPWIGQYX4G5LZXL7ZBJN3KY6RM3/ - https://lists.debian.org/debian-lts-announce/2022/11/msg00014.html
CVE ID: CVE-2019-16168 State: PUBLISHED Published: 2019-09-09T16:07:15 Last Updated: 2024-08-05T01:10:41.487Z Vendors: n/a Products: n/a Problem Types: n/a Description: In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a "severe division by zero in the query planner." Additional Analyst Notes: - CVE Program Container: References: - https://www.mail-archive.com/sqlite-users%40mailinglists.sqlite.org/msg116312.html - https://www.sqlite.org/src/timeline?c=98357d8c1263920b - https://www.sqlite.org/src/info/e4598ecbdd18bd82945f6029013296690e719a62 - https://security.netapp.com/adviso
1263920b - https://www.sqlite.org/src/info/e4598ecbdd18bd82945f6029013296690e719a62 - https://security.netapp.com/advisory/ntap-20190926-0003/ - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00033.html - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00032.html - https://usn.ubuntu.com/4205-1/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XZARJHJJDBHI7CE5PZEBXS5HKK6HXKW2/ - https://www.oracle.com/security-alerts/cpujan2020.html - https://security.netapp.com/advisory/ntap-20200122-0003/ - https://security.gentoo.org/glsa/202003-16 - https://www.oracle.com/security-alerts/cpuapr2020.html - https://lists.deb
https://security.gentoo.org/glsa/202003-16 - https://www.oracle.com/security-alerts/cpuapr2020.html - https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html - https://www.tenable.com/security/tns-2021-08 - https://www.tenable.com/security/tns-2021-11 - https://www.tenable.com/security/tns-2021-14 - https://kc.mcafee.com/corporate/index?page=content&id=SB10365
CVE ID: CVE-2019-16170 State: PUBLISHED Published: 2019-09-16T11:59:41 Last Updated: 2024-08-05T01:10:41.119Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GitLab Enterprise Edition 11.x and 12.x before 12.0.9, 12.1.x before 12.1.9, and 12.2.x before 12.2.5. It has Incorrect Access Control. Additional Analyst Notes: - CVE Program Container: References: - https://about.gitlab.com/2019/09/10/critical-security-release-gitlab-12-dot-2-dot-5-released/
CVE ID: CVE-2019-16171 State: PUBLISHED Published: 2019-10-02T18:24:00 Last Updated: 2024-08-05T01:10:41.408Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JetBrains YouTrack through 2019.2.56594, stored XSS was found on the issue page. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com/blog/2019/09/26/jetbrains-security-bulletin-q2-2019/
CVE ID: CVE-2019-16172 State: PUBLISHED Published: 2019-09-09T18:23:53 Last Updated: 2024-08-05T01:10:41.288Z Vendors: n/a Products: n/a Problem Types: n/a Description: LimeSurvey before v3.17.14 allows stored XSS for escalating privileges from a low-privileged account to, for example, SuperAdmin. The attack uses a survey group in which the title contains JavaScript that is mishandled upon group deletion. Additional Analyst Notes: - CVE Program Container: References: - https://www.limesurvey.org/limesurvey-updates/2188-limesurvey-3-17-14-build-190902-released - https://github.com/LimeSurvey/LimeSurvey/commit/32d6a5224327b246ee3a2a08500544e4f80f9a9a - http://seclists.org/fulldisclosure/2019/S
ub.com/LimeSurvey/LimeSurvey/commit/32d6a5224327b246ee3a2a08500544e4f80f9a9a - http://seclists.org/fulldisclosure/2019/Sep/22 - http://packetstormsecurity.com/files/154479/LimeSurvey-3.17.13-Cross-Site-Scripting.html - https://seclists.org/bugtraq/2019/Sep/27
CVE ID: CVE-2019-16173 State: PUBLISHED Published: 2019-09-09T18:23:32 Last Updated: 2024-08-05T01:10:41.040Z Vendors: n/a Products: n/a Problem Types: n/a Description: LimeSurvey before v3.17.14 allows reflected XSS for escalating privileges from a low-privileged account to, for example, SuperAdmin. This occurs in application/core/Survey_Common_Action.php, Additional Analyst Notes: - CVE Program Container: References: - https://www.limesurvey.org/limesurvey-updates/2188-limesurvey-3-17-14-build-190902-released - https://github.com/LimeSurvey/LimeSurvey/commit/f1c1ad2d24eb262363511fcca2e96ce737064006 - http://seclists.org/fulldisclosure/2019/Sep/22 - http://packetstormsecurity.com/files/1544
62363511fcca2e96ce737064006 - http://seclists.org/fulldisclosure/2019/Sep/22 - http://packetstormsecurity.com/files/154479/LimeSurvey-3.17.13-Cross-Site-Scripting.html - https://seclists.org/bugtraq/2019/Sep/27
CVE ID: CVE-2019-16174 State: PUBLISHED Published: 2019-09-09T20:43:01 Last Updated: 2024-08-05T01:10:41.543Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XML injection vulnerability was found in Limesurvey before 3.17.14 that allows remote attackers to import specially crafted XML files and execute code or compromise data integrity. Additional Analyst Notes: - CVE Program Container: References: - https://www.limesurvey.org/limesurvey-updates/2188-limesurvey-3-17-14-build-190902-released - https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R40
CVE ID: CVE-2019-16175 State: PUBLISHED Published: 2019-09-09T20:42:10 Last Updated: 2024-08-05T01:10:41.385Z Vendors: n/a Products: n/a Problem Types: n/a Description: A clickjacking vulnerability was found in Limesurvey before 3.17.14. Additional Analyst Notes: - CVE Program Container: References: - https://www.limesurvey.org/limesurvey-updates/2188-limesurvey-3-17-14-build-190902-released - https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R41
CVE ID: CVE-2019-16176 State: PUBLISHED Published: 2019-09-09T20:40:10 Last Updated: 2024-08-05T01:10:41.248Z Vendors: n/a Products: n/a Problem Types: n/a Description: A path disclosure vulnerability was found in Limesurvey before 3.17.14 that allows a remote attacker to discover the path to the application in the filesystem. Additional Analyst Notes: - CVE Program Container: References: - https://www.limesurvey.org/limesurvey-updates/2188-limesurvey-3-17-14-build-190902-released - https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R43