Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
Affects: Builds of dhcpd versions prior to version 4.4.1 when using BIND versions 9.11.2 or later, or BIND versions with specific bug fixes backported to them. ISC does not have access to comprehensive version lists for all repackagings of dhcpd that are vulnerable. In particular, builds from other vendors may also be affected. Operators are advised to consult their vendor documentation. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2019:2060 - https://lists.opensuse.org/opensuse-security-announce/2019-10/msg00049.html - https://lists.opensuse.org/opensuse-security-announce/2019-10/msg00048.html - https://bugs.debian.org/cgi-bin/bugre
ml - https://lists.opensuse.org/opensuse-security-announce/2019-10/msg00048.html - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=896122 - https://access.redhat.com/errata/RHSA-2019:3525
CVE ID: CVE-2019-6471 State: PUBLISHED Published: 2019-10-09T14:17:14.566217Z Last Updated: 2024-09-17T01:56:17.224Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ISC Products: BIND 9 Problem Types: An attacker who can cause a resolver to perform queries which will be answered by a server which responds with deliberately malformed answers can cause named to exit, denying service to clients. Description: A race condition which may occur when discarding malformed packets can result in BIND exiting due to a REQUIRE assertion failure in dispatch.c. Versions affected: BIND 9.11.0 -> 9.11.7, 9.12.0 -> 9.12.4-P1, 9.14.0 -> 9.14.2. Also all releases of the BIND 9.
tch.c. Versions affected: BIND 9.11.0 -> 9.11.7, 9.12.0 -> 9.12.4-P1, 9.14.0 -> 9.14.2. Also all releases of the BIND 9.13 development branch and version 9.15.0 of the BIND 9.15 development branch and BIND Supported Preview Edition versions 9.11.3-S1 -> 9.11.7-S1. Additional Analyst Notes: - CVE Program Container: References: - https://kb.isc.org/docs/cve-2019-6471 - https://support.f5.com/csp/article/K10092301?utm_source=f5support&amp%3Butm_medium=RSS
CVE ID: CVE-2019-6472 State: PUBLISHED Published: 2019-10-16T17:22:16.689124Z Last Updated: 2024-09-17T03:58:54.278Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ISC Products: Kea Problem Types: An attacker who is able to send a request containing a malformed DUID to the server (either directly or via a relay) can cause the DHCPv6 server process to terminate, denying service to clients. Only the DHCPv6 service is affected by this vulnerability. Description: A packet containing a malformed DUID can cause the Kea DHCPv6 server process (kea-dhcp6) to exit due to an assertion failure. Versions affected: 1.4.0 to 1.5.0, 1.6.0-beta1, and 1.6.0-beta2. Additional
-dhcp6) to exit due to an assertion failure. Versions affected: 1.4.0 to 1.5.0, 1.6.0-beta1, and 1.6.0-beta2. Additional Analyst Notes: - CVE Program Container: References: - https://kb.isc.org/docs/cve-2019-6472
CVE ID: CVE-2019-6473 State: PUBLISHED Published: 2019-10-16T17:22:16.730038Z Last Updated: 2024-09-16T22:30:41.265Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ISC Products: Kea Problem Types: An attacker who is able to deliberately exploit this vulnerability can cause the kea-dhcp4 server to stop executing, resulting in denial of service to clients. Only the DHCPv4 service is affected by this vulnerability. Description: An invalid hostname option can trigger an assertion failure in the Kea DHCPv4 server process (kea-dhcp4), causing the server process to exit. Versions affected: 1.4.0 to 1.5.0, 1.6.0-beta1, and 1.6.0-beta2. Additional Analyst Notes: - C
e server process to exit. Versions affected: 1.4.0 to 1.5.0, 1.6.0-beta1, and 1.6.0-beta2. Additional Analyst Notes: - CVE Program Container: References: - https://kb.isc.org/docs/cve-2019-6473
CVE ID: CVE-2019-6474 State: PUBLISHED Published: 2019-10-16T17:22:16.767968Z Last Updated: 2024-09-16T22:19:36.160Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: ISC Products: Kea Problem Types: Only Kea servers which use memfile storage for leases are affected by this vulnerability. An attacker can exploit the missing check to deliberately create a situation where the server will not restart properly should it stop for any reason. Description: A missing check on incoming client requests can be exploited to cause a situation where the Kea server's lease storage contains leases which are rejected as invalid when the server tries to load leases from storage
a server's lease storage contains leases which are rejected as invalid when the server tries to load leases from storage on restart. If the number of such leases exceeds a hard-coded limit in the Kea code, a server trying to restart will conclude that there is a problem with its lease store and give up. Versions affected: 1.4.0 to 1.5.0, 1.6.0-beta1, and 1.6.0-beta2 Additional Analyst Notes: - CVE Program Container: References: - https://kb.isc.org/docs/cve-2019-6474
CVE ID: CVE-2019-6475 State: PUBLISHED Published: 2019-10-17T19:17:36.355066Z Last Updated: 2024-09-16T17:54:52.004Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: ISC Products: BIND 9 Problem Types: An on-path attacker who manages to successfully exploit this vulnerability can replace the mirrored zone (usually the root) with data of their own choosing, effectively bypassing DNSSEC protection. Description: Mirror zones are a BIND feature allowing recursive servers to pre-cache zone data provided by other servers. A mirror zone is similar to a zone of type secondary, except that its data is subject to DNSSEC validation before being used in answers, as if it
to a zone of type secondary, except that its data is subject to DNSSEC validation before being used in answers, as if it had been looked up via traditional recursion, and when mirror zone data cannot be validated, BIND falls back to using traditional recursion instead of the mirror zone. However, an error in the validity checks for the incoming zone data can allow an on-path attacker to replace zone data that was validated with a configured trust anchor with forged data of the attacker's choosing. The mirror zone feature is most often used to serve a local copy of the root zone. If an attacker was able to insert themselves into the network path between a recursive server using a mirror zone
zone. If an attacker was able to insert themselves into the network path between a recursive server using a mirror zone and a root name server, this vulnerability could then be used to cause the recursive server to accept a copy of falsified root zone data. This affects BIND versions 9.14.0 up to 9.14.6, and 9.15.0 up to 9.15.4. Additional Analyst Notes: - CVE Program Container: References: - https://kb.isc.org/docs/cve-2019-6475 - https://security.netapp.com/advisory/ntap-20191024-0004/ - https://support.f5.com/csp/article/K42238532?utm_source=f5support&amp%3Butm_medium=RSS
CVE ID: CVE-2019-6476 State: PUBLISHED Published: 2019-10-17T19:17:39.240770Z Last Updated: 2024-09-16T16:58:26.060Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ISC Products: BIND 9 Problem Types: An attacker who manages to deliberately trigger this condition on a server which is performing recursion can cause named to exit, denying service to clients. Description: A defect in code added to support QNAME minimization can cause named to exit with an assertion failure if a forwarder returns a referral rather than resolving the query. This affects BIND versions 9.14.0 up to 9.14.6, and 9.15.0 up to 9.15.4. Additional Analyst Notes: - CVE Program Container:
affects BIND versions 9.14.0 up to 9.14.6, and 9.15.0 up to 9.15.4. Additional Analyst Notes: - CVE Program Container: References: - https://kb.isc.org/docs/cve-2019-6476 - https://security.netapp.com/advisory/ntap-20191024-0004/ - https://support.f5.com/csp/article/K42238532?utm_source=f5support&amp%3Butm_medium=RSS
CVE ID: CVE-2019-6477 State: PUBLISHED Published: 2019-11-26T16:11:16.500185Z Last Updated: 2024-09-16T16:47:45.899Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ISC Products: BIND9 Problem Types: By design, BIND is intended to limit the number of TCP clients that can be connected at any given time. The update to this functionality introduced by CVE-2018-5743 changed how BIND calculates the number of concurrent TCP clients from counting the outstanding TCP queries to counting the TCP client connections. On a server with TCP-pipelining capability, it is possible for one TCP client to send a large number of DNS requests over a single connection. Each outstand
bility, it is possible for one TCP client to send a large number of DNS requests over a single connection. Each outstanding query will be handled internally as an independent client request, thus bypassing the new TCP clients limit. 9.11.6-P1 -> 9.11.12, 9.12.4-P1 -> 9.12.4-P2, 9.14.1 -> 9.14.7, and versions 9.11.5-S6 -> 9.11.12-S1 of BIND 9 Supported Preview Edition. Versions 9.15.0 -> 9.15.5 of the BIND 9.15 development branch are also affected. Description: With pipelining enabled each incoming query on a TCP connection requires a similar resource allocation to a query received via UDP or via TCP without pipelining enabled. A client using a TCP-pipelined connection to a server could consu
eceived via UDP or via TCP without pipelining enabled. A client using a TCP-pipelined connection to a server could consume more resources than the server has been provisioned to handle. When a TCP connection with a large number of pipelined queries is closed, the load on the server releasing these multiple resources can cause it to become unresponsive, even for queries that can be answered authoritatively or from cache. (This is most likely to be perceived as an intermittent server problem). Additional Analyst Notes: - CVE Program Container: References: - https://kb.isc.org/docs/cve-2019-6477 - https://www.synology.com/security/advisory/Synology_SA_19_39 - https://lists.fedoraproject.org/arc
/docs/cve-2019-6477 - https://www.synology.com/security/advisory/Synology_SA_19_39 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XGURMGQHX45KR4QDRCSUQHODUFOGNGAN/ - https://support.f5.com/csp/article/K15840535?utm_source=f5support&amp%3Butm_medium=RSS - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3DEMNZMKR57VQJCG5ZN55ZGTQRL2TFQ/ - https://www.debian.org/security/2020/dsa-4689 - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00041.html - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00044.html
CVE ID: CVE-2019-6478 State: REJECTED Published: 2020-02-06T21:00:23 Last Updated: 2020-02-06T21:00:23 Description: No description available.
CVE ID: CVE-2019-6479 State: REJECTED Published: 2020-02-06T21:00:23 Last Updated: 2020-02-06T21:00:23 Description: No description available.
CVE ID: CVE-2019-6481 State: PUBLISHED Published: 2019-03-29T13:22:06 Last Updated: 2024-08-04T20:23:20.994Z Vendors: n/a Products: n/a Problem Types: n/a Description: Abine Blur 7.8.2431 allows remote attackers to conduct "Second-Factor Auth Bypass" attacks by using the "Perform a right-click operation to access a forgotten dev menu to insert user passwords that otherwise would require the user to accept a second-factor request in a mobile app." approach, related to a "Multifactor Auth Bypass, Full Disk Encryption Bypass" issue affecting the Affected Chrome Plugin component. Additional Analyst Notes: - CVE Program Container: References: - https://redcoded.com/cve/2018/03/10/CVE.html - https
t. Additional Analyst Notes: - CVE Program Container: References: - https://redcoded.com/cve/2018/03/10/CVE.html - https://redcoded.com/cve/2019/03/18/CVE.html - http://seclists.org/fulldisclosure/2019/Mar/33 - http://packetstormsecurity.com/files/152139/Abine-Blur-7.8.24x-Authentication-Bypass.html
CVE ID: CVE-2019-6485 State: PUBLISHED Published: 2019-02-22T23:00:00 Last Updated: 2024-08-04T20:23:21.376Z Vendors: n/a Products: n/a Problem Types: n/a Description: Citrix NetScaler Gateway 12.1 before build 50.31, 12.0 before build 60.9, 11.1 before build 60.14, 11.0 before build 72.17, and 10.5 before build 69.5 and Application Delivery Controller (ADC) 12.1 before build 50.31, 12.0 before build 60.9, 11.1 before build 60.14, 11.0 before build 72.17, and 10.5 before build 69.5 allow remote attackers to obtain sensitive plaintext information because of a TLS Padding Oracle Vulnerability when CBC-based cipher suites are enabled. Additional Analyst Notes: - CVE Program Container: Reference
cle Vulnerability when CBC-based cipher suites are enabled. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/RUB-NDS/TLS-Padding-Oracles - https://support.citrix.com/article/CTX240139 - http://www.securityfocus.com/bid/106783
CVE ID: CVE-2019-6486 State: PUBLISHED Published: 2019-01-24T05:00:00 Last Updated: 2024-08-04T20:23:20.998Z Vendors: n/a Products: n/a Problem Types: n/a Description: Go before 1.10.8 and 1.11.x before 1.11.5 mishandles P-521 and P-384 elliptic curves, which allows attackers to cause a denial of service (CPU consumption) or possibly conduct ECDH private key recovery attacks. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/golang/go/issues/29903 - https://www.debian.org/security/2019/dsa-4380 - https://groups.google.com/forum/#%21topic/golang-announce/mVeX35iXuSw - https://www.debian.org/security/2019/dsa-4379 - https://github.com/golang/go/commit/42b42f71
lang-announce/mVeX35iXuSw - https://www.debian.org/security/2019/dsa-4379 - https://github.com/golang/go/commit/42b42f71cf8f5956c09e66230293dfb5db652360 - https://lists.debian.org/debian-lts-announce/2019/02/msg00009.html - http://www.securityfocus.com/bid/106740 - https://github.com/google/wycheproof - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00042.html - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00060.html - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00011.html - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00015.html
CVE ID: CVE-2019-6487 State: PUBLISHED Published: 2019-01-18T10:00:00Z Last Updated: 2024-09-17T03:22:42.398Z Vendors: n/a Products: n/a Problem Types: n/a Description: TP-Link WDR Series devices through firmware v3 (such as TL-WDR5620 V3.0) are affected by command injection (after login) leading to remote code execution, because shell metacharacters can be included in the weather get_weather_observe citycode field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/0xcc-Since2016/TP-Link-WDR-Router-Command-injection_POC/blob/master/poc.py
CVE ID: CVE-2019-6488 State: PUBLISHED Published: 2019-01-18T19:00:00 Last Updated: 2024-08-04T20:23:20.957Z Vendors: n/a Products: n/a Problem Types: n/a Description: The string component in the GNU C Library (aka glibc or libc6) through 2.28, when running on the x32 architecture, incorrectly attempts to use a 64-bit register for size_t in assembly codes, which can lead to a segmentation fault or possibly unspecified other impact, as demonstrated by a crash in __memmove_avx_unaligned_erms in sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S during a memcpy. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106671 - https://sourceware.org/b
Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106671 - https://sourceware.org/bugzilla/show_bug.cgi?id=24097 - https://security.gentoo.org/glsa/202006-04
CVE ID: CVE-2019-6489 State: PUBLISHED Published: 2019-02-11T21:00:00 Last Updated: 2024-08-04T20:23:20.959Z Vendors: n/a Products: n/a Problem Types: n/a Description: Certain Lexmark CX, MX, X, XC, XM, XS, and 6500e devices before 2019-02-11 allow remote attackers to erase stored shortcuts. Additional Analyst Notes: - CVE Program Container: References: - http://support.lexmark.com/index?page=content&id=TE912
CVE ID: CVE-2019-6491 State: PUBLISHED Published: 2019-03-21T15:36:27 Last Updated: 2024-08-04T20:23:21.000Z Vendors: n/a Products: n/a Problem Types: n/a Description: RISI Gestao de Horarios v3201.09.08 rev.23 allows SQL Injection. Additional Analyst Notes: - CVE Program Container: References: - https://www.0x90.zone/web/sqli/2019/02/01/risi-gestaohorario.html
CVE ID: CVE-2019-6492 State: PUBLISHED Published: 2019-03-18T21:16:18 Last Updated: 2024-08-04T20:23:22.105Z Vendors: n/a Products: n/a Problem Types: n/a Description: SmartDefragDriver.sys (2.0) in IObit Smart Defrag 6 never frees an executable kernel pool that is allocated with user defined bytes and size when IOCTL 0x9C401CC4 is called. This kernel pointer can be leaked if the kernel pool becomes a "big" pool. Additional Analyst Notes: - CVE Program Container: References: - https://downwithup.github.io/CVEPosts.html
CVE ID: CVE-2019-6493 State: PUBLISHED Published: 2019-04-11T19:34:00 Last Updated: 2024-08-04T20:23:21.446Z Vendors: n/a Products: n/a Problem Types: n/a Description: SmartDefragDriver.sys (2.0) in IObit Smart Defrag 6 never frees an executable kernel pool that is allocated with user defined bytes and size when IOCTL 0x9C401CC0 is called. This kernel pointer can be leaked if the kernel pool becomes a "big" pool. Additional Analyst Notes: - CVE Program Container: References: - https://downwithup.github.io/CVEPosts.html - https://www.iobit.com/en/iobitsmartdefrag.php
CVE ID: CVE-2019-6494 State: PUBLISHED Published: 2019-04-30T14:24:25 Last Updated: 2024-08-04T20:23:22.186Z Vendors: n/a Products: n/a Problem Types: n/a Description: IMFForceDelete.sys in IObit Malware Fighter 6.2 allows a low privileged user to send IOCTL 0x8016E000 along with a user defined string to a file; that file will be promptly deleted regardless of access controls. Additional Analyst Notes: - CVE Program Container: References: - https://downwithup.github.io/CVEPosts.html
CVE ID: CVE-2019-6496 State: PUBLISHED Published: 2019-01-19T17:00:00 Last Updated: 2024-08-04T20:23:21.334Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ThreadX-based firmware on Marvell Avastar Wi-Fi devices, models 88W8787, 88W8797, 88W8801, 88W8897, and 88W8997, allows remote attackers to execute arbitrary code or cause a denial of service (block pool overflow) via malformed Wi-Fi packets during identification of available Wi-Fi networks. Exploitation of the Wi-Fi device can lead to exploitation of the host application processor in some cases, but this depends on several factors including host OS hardening and the availability of DMA. Additional Analyst Notes: - CVE Pro
depends on several factors including host OS hardening and the availability of DMA. Additional Analyst Notes: - CVE Program Container: References: - https://www.scribd.com/document/398350818/WiFi-CVE-2019-6496-Marvell-s-Statement - http://www.securityfocus.com/bid/106865 - https://2018.zeronights.ru/wp-content/uploads/materials/19-Researching-Marvell-Avastar-Wi-Fi.pdf - https://embedi.org/blog/remotely-compromise-devices-by-using-bugs-in-marvell-avastar-wi-fi-from-zero-knowledge-to-zero-click-rce/ - https://www.zdnet.com/article/wifi-firmware-bug-affects-laptops-smartphones-routers-gaming-devices/ - https://www.synology.com/security/advisory/Synology_SA_19_07 - https://www.kb.cert.org/vuls/
s-routers-gaming-devices/ - https://www.synology.com/security/advisory/Synology_SA_19_07 - https://www.kb.cert.org/vuls/id/730261/
CVE ID: CVE-2019-6497 State: PUBLISHED Published: 2019-01-19T17:00:00Z Last Updated: 2024-09-16T20:12:34.809Z Vendors: n/a Products: n/a Problem Types: n/a Description: Hotels_Server through 2018-11-05 has SQL Injection via the controller/fetchpwd.php username parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FantasticLBP/Hotels_Server/issues/1
CVE ID: CVE-2019-6498 State: PUBLISHED Published: 2019-01-21T06:00:00 Last Updated: 2024-08-04T20:23:22.204Z Vendors: n/a Products: n/a Problem Types: n/a Description: GattLib 0.2 has a stack-based buffer over-read in gattlib_connect in dbus/gattlib.c because strncpy is misused. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/46215/ - https://github.com/labapart/gattlib/issues/82 - https://github.com/labapart/gattlib/issues/81
CVE ID: CVE-2019-6499 State: PUBLISHED Published: 2019-01-21T06:00:00 Last Updated: 2024-08-04T20:23:21.482Z Vendors: n/a Products: n/a Problem Types: n/a Description: Teradata Viewpoint before 14.0 and 16.20.00.02-b80 contains a hardcoded password of TDv1i2e3w4 for the viewpoint database account (in viewpoint-portal\conf\server.xml) that could potentially be exploited by malicious users to compromise the affected system. Additional Analyst Notes: - CVE Program Container: References: - https://inf0seq.github.io/cve/2019/01/20/Teradata-Viewpoint-Hardcoded-Password-Vulnerability.html - https://github.com/inf0seq/inf0seq.github.io/blob/master/_posts/2019-01-20-Teradata%20Viewpoint%20Hardcoded%2
ity.html - https://github.com/inf0seq/inf0seq.github.io/blob/master/_posts/2019-01-20-Teradata%20Viewpoint%20Hardcoded%20Password%20Vulnerability.md
CVE ID: CVE-2019-6500 State: PUBLISHED Published: 2019-01-21T06:00:00 Last Updated: 2024-08-04T20:23:22.211Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Axway File Transfer Direct 2.7.1, an unauthenticated Directory Traversal vulnerability can be exploited by issuing a specially crafted HTTP GET request with %2e instead of '.' characters, as demonstrated by an initial /h2hdocumentation//%2e%2e/ substring. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/inf0seq/inf0seq.github.io/blob/master/_posts/2019-01-20-Directory-Traversal-in-Axway-File-Transfer-Direct.md - https://inf0seq.github.io/cve/2019/01/20/Directory-Traversal-in-Axway-File-Tra
versal-in-Axway-File-Transfer-Direct.md - https://inf0seq.github.io/cve/2019/01/20/Directory-Traversal-in-Axway-File-Transfer-Direct.html
CVE ID: CVE-2019-6501 State: PUBLISHED Published: 2019-03-17T16:51:48 Last Updated: 2024-08-04T20:23:22.063Z Vendors: n/a Products: n/a Problem Types: n/a Description: In QEMU 3.1, scsi_handle_inquiry_reply in hw/scsi/scsi-generic.c allows out-of-bounds write and read operations. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2019/01/24/1 - https://lists.gnu.org/archive/html/qemu-devel/2019-01/msg02324.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJMTVGDLA654HNCDGLCUEIP36SNJEKK7/ - https://security.netapp.com/advisory/ntap-20190411-0006/ - https://access.redhat.com/errata/R
654HNCDGLCUEIP36SNJEKK7/ - https://security.netapp.com/advisory/ntap-20190411-0006/ - https://access.redhat.com/errata/RHSA-2019:2166 - https://access.redhat.com/errata/RHSA-2019:2425 - https://access.redhat.com/errata/RHSA-2019:2553
CVE ID: CVE-2019-6502 State: PUBLISHED Published: 2019-01-22T00:00:00 Last Updated: 2024-08-04T20:23:21.292Z Vendors: n/a Products: n/a Problem Types: n/a Description: sc_context_create in ctx.c in libopensc in OpenSC 0.19.0 has a memory leak, as demonstrated by a call from eidenv. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OpenSC/OpenSC/issues/1586 - http://www.openwall.com/lists/oss-security/2019/12/29/1 - https://lists.debian.org/debian-lts-announce/2023/06/msg00025.html
CVE ID: CVE-2019-6503 State: PUBLISHED Published: 2019-01-22T14:00:00Z Last Updated: 2024-09-16T23:01:28.285Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a deserialization vulnerability in Chatopera cosin v3.10.0. An attacker can execute commands during server-side deserialization by uploading maliciously constructed files. This is related to the TemplateController.java impsave method and the MainUtils toObject method. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/chatopera/cosin/issues/177