Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
/debian-lts-announce/2019/09/msg00014.html - https://lists.debian.org/debian-lts-announce/2019/09/msg00015.html - https://usn.ubuntu.com/4145-1/ - https://access.redhat.com/errata/RHSA-2020:0174 - https://security.netapp.com/advisory/ntap-20190517-0005/ - https://www.oracle.com/security-alerts/cpuApr2021.html - https://github.com/torvalds/linux/commit/6b3a707736301c2128ca85ce85fb13f60b5e350a - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6b3a707736301c2128ca85ce85fb13f60b5e350a - https://github.com/torvalds/linux/commit/15fab63e1e57be9fdb5eec1bbc5916e9825e9acb - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=15fab63e1e57be9fdb5eec1bbc
bc5916e9825e9acb - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=15fab63e1e57be9fdb5eec1bbc5916e9825e9acb - https://github.com/torvalds/linux/commit/8fde12ca79aff9b5ba951fce1a2641901b8d8e64 - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8fde12ca79aff9b5ba951fce1a2641901b8d8e64 - https://github.com/torvalds/linux/commit/88b1a17dfc3ed7728316478fae0f5ad508f50397 - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=88b1a17dfc3ed7728316478fae0f5ad508f50397 - https://github.com/torvalds/linux/commit/f958d7b528b1b40c44cfda5eabe2d82760d868c3 - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=
t/f958d7b528b1b40c44cfda5eabe2d82760d868c3 - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f958d7b528b1b40c44cfda5eabe2d82760d868c3 - https://bugs.chromium.org/p/project-zero/issues/detail?id=1752 - https://lwn.net/Articles/786044/ - https://support.f5.com/csp/article/K14255532
CVE ID: CVE-2019-11488 State: PUBLISHED Published: 2019-04-25T20:08:01 Last Updated: 2024-08-04T22:55:40.136Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect Access Control in the Account Access / Password Reset Link in SimplyBook.me Enterprise before 2019-04-23 allows Unauthorized Attackers to READ/WRITE Customer or Administrator data via a persistent HTTP GET Request Hash Link Replay, as demonstrated by a login-link from the browser history. Additional Analyst Notes: - CVE Program Container: References: - https://cybrgrade.com/files/Report_SimplyBookIt_MD5_Hash_Replay_by_CybrGradeUKLtd.pdf - https://blog.cybrgrade.com/CVE-2019-11488-SimplyBook.me-hash-replay-attack/
CVE ID: CVE-2019-11489 State: PUBLISHED Published: 2019-04-25T20:02:41 Last Updated: 2024-08-04T22:55:40.323Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect Access Control in the Administrative Management Interface in SimplyBook.me Enterprise before 2019-04-23 allows Authenticated Low-Priv Users to Elevate Privileges to Full Admin Rights via a crafted HTTP PUT Request, as demonstrated by modified JSON data to a /v2/rest/ URI. Additional Analyst Notes: - CVE Program Container: References: - https://cybrgrade.com/files/Report_SimplyBookIt_Privesc_by_CybrGradeUKLtd.pdf - https://blog.cybrgrade.com/CVE-2019-11489-SimplyBook.me-privesc/
CVE ID: CVE-2019-11490 State: PUBLISHED Published: 2019-04-24T02:40:38 Last Updated: 2024-08-04T22:55:40.638Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Npcap 0.992. Sending a malformed .pcap file with the loopback adapter using either pcap_sendqueue_queue() or pcap_sendqueue_transmit() results in kernel pool corruption. This could lead to arbitrary code executing inside the Windows kernel and allow escalation of privileges. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nmap/nmap/issues/1568
CVE ID: CVE-2019-11492 State: PUBLISHED Published: 2019-04-26T20:02:17 Last Updated: 2024-08-04T22:55:40.444Z Vendors: n/a Products: n/a Problem Types: n/a Description: ProjectSend before r1070 writes user passwords to the server logs. Additional Analyst Notes: - CVE Program Container: References: - https://www.projectsend.org/change-log/
CVE ID: CVE-2019-11493 State: PUBLISHED Published: 2019-04-26T13:42:21 Last Updated: 2024-08-04T22:55:40.864Z Vendors: n/a Products: n/a Problem Types: n/a Description: VeryPDF 4.1 has a Memory Overflow leading to Code Execution because pdfocx!CxImageTIF::operator in pdfocx.ocx (used by pdfeditor.exe and pdfcmd.exe) is mishandled. Additional Analyst Notes: - CVE Program Container: References: - https://www.vdalabs.com/2019/04/25/microsoft-security-risk-detection-0day-in-verypdf-reader-part-1/
CVE ID: CVE-2019-11494 State: PUBLISHED Published: 2019-05-08T17:04:02 Last Updated: 2024-08-04T22:55:40.377Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AC:L/AV:N/A:H/C:N/I:N/PR:N/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: In the IMAP Server in Dovecot 2.3.3 through 2.3.5.2, the submission-login service crashes when the client disconnects prematurely during the AUTH command. Additional Analyst Notes: - CVE Program Container: References: - https://www.dovecot.org/security.html - https://www.dovecot.org/download.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4XLI55NGRDTGMVOPYFCPPFNPA5VKYSSY/ - https://lists.fedoraproject
/list/package-announce%40lists.fedoraproject.org/message/4XLI55NGRDTGMVOPYFCPPFNPA5VKYSSY/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QHFZ5OWRIZGIWZJ5PTNVWWZNLLNH4XYS/ - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00026.html - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00024.html
CVE ID: CVE-2019-11495 State: PUBLISHED Published: 2019-09-10T17:16:29 Last Updated: 2024-08-04T22:55:40.284Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Couchbase Server 5.1.1, the cookie used for intra-node communication was not generated securely. Couchbase Server uses erlang:now() to seed the PRNG which results in a small search space for potential random seeds that could then be used to brute force the cookie and execute code against a remote system. This has been fixed in version 6.0.0. Additional Analyst Notes: - CVE Program Container: References: - https://www.couchbase.com/resources/security#SecurityAlerts
CVE ID: CVE-2019-11496 State: PUBLISHED Published: 2019-09-10T17:26:15 Last Updated: 2024-08-04T22:55:40.691Z Vendors: n/a Products: n/a Problem Types: n/a Description: In versions of Couchbase Server prior to 5.0, the bucket named "default" was a special bucket that allowed read and write access without authentication. As part of 5.0, the behavior of all buckets including "default" were changed to only allow access by authenticated users with sufficient authorization. However, users were allowed unauthenticated and unauthorized access to the "default" bucket if the properties of this bucket were edited. This has been fixed in versions 5.1.0 and 5.5.0. Additional Analyst Notes: - CVE Program
ies of this bucket were edited. This has been fixed in versions 5.1.0 and 5.5.0. Additional Analyst Notes: - CVE Program Container: References: - https://www.couchbase.com/resources/security#SecurityAlerts
CVE ID: CVE-2019-11497 State: PUBLISHED Published: 2019-09-10T17:24:04 Last Updated: 2024-08-04T22:55:40.632Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Couchbase Server 5.0.0, when an invalid Remote Cluster Certificate was entered as part of the reference creation, XDCR did not parse and check the certificate signature. It then accepted the invalid certificate and attempted to use it to establish future connections to the remote cluster. This has been fixed in version 5.5.0. XDCR now checks the validity of the certificate thoroughly and prevents a remote cluster reference from being created with an invalid certificate. Additional Analyst Notes: - CVE Program Container: Re
cluster reference from being created with an invalid certificate. Additional Analyst Notes: - CVE Program Container: References: - https://www.couchbase.com/resources/security#SecurityAlerts
CVE ID: CVE-2019-11498 State: PUBLISHED Published: 2019-04-24T04:03:05 Last Updated: 2024-08-04T22:55:40.595Z Vendors: n/a Products: n/a Problem Types: n/a Description: WavpackSetConfiguration64 in pack_utils.c in libwavpack.a in WavPack through 5.1.0 has a "Conditional jump or move depends on uninitialised value" condition, which might allow attackers to cause a denial of service (application crash) via a DFF file that lacks valid sample-rate data. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dbry/WavPack/issues/67 - https://github.com/dbry/WavPack/commit/bc6cba3f552c44565f7f1e66dc1580189addb2b4 - https://usn.ubuntu.com/3960-1/ - https://lists.fedorapr
m/dbry/WavPack/commit/bc6cba3f552c44565f7f1e66dc1580189addb2b4 - https://usn.ubuntu.com/3960-1/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NZDKXGA2ZNSSM64ZYDHOWCO4Q4VAKAON/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SCK2YJXY6V5CKGKSF2PPN7RL2DXVOC6G/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CFFFWIWALGQPKINRDW3PRGRD5LOLGZA/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BRWQNE3TH5UF64IKHKKHVCHJHUOVKJUH/ - https://security.gentoo.org/glsa/202007-19 - https://lists.debian.org/
t.org/message/BRWQNE3TH5UF64IKHKKHVCHJHUOVKJUH/ - https://security.gentoo.org/glsa/202007-19 - https://lists.debian.org/debian-lts-announce/2021/01/msg00013.html
CVE ID: CVE-2019-11499 State: PUBLISHED Published: 2019-05-08T17:00:15 Last Updated: 2024-08-04T22:55:40.396Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the IMAP Server in Dovecot 2.3.3 through 2.3.5.2, the submission-login component crashes if AUTH PLAIN is attempted over a TLS secured channel with an unacceptable authentication message. Additional Analyst Notes: - CVE Program Container: References: - https://www.dovecot.org/security.html - https://www.dovecot.org/download.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4XLI55NGRDTGMVOPYFCPPFNPA5VKYSSY/ - https://lists.fedoraproject.org/archives/list/package-announce
raproject.org/message/4XLI55NGRDTGMVOPYFCPPFNPA5VKYSSY/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QHFZ5OWRIZGIWZJ5PTNVWWZNLLNH4XYS/ - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00026.html - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00024.html
CVE ID: CVE-2019-11500 State: PUBLISHED Published: 2019-08-29T13:51:46 Last Updated: 2024-08-04T22:55:40.604Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2), protocol processing can fail for quoted strings. This occurs because '\0' characters are mishandled, and can lead to out-of-bounds writes and remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.dovecot.org/security.html - http://www.openwall.com/lists/oss-security/2019/08/28/3 - https://dovecot.org/pipermail/dovecot-news/2019-August/000417.html - https://lists.debian.org/debian-lts-announce/2019
- https://dovecot.org/pipermail/dovecot-news/2019-August/000417.html - https://lists.debian.org/debian-lts-announce/2019/08/msg00035.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3GYTZLLDNIFWT7D7JSB25ERJNMOR4CQ3/ - https://security.gentoo.org/glsa/201908-29 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KVHY3MU2OK2EWZJFGNDSAOMD42L7DFPX/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YSJVVVRAE3SITC2ZLGCPMFDN3WVYZBWF/ - https://access.redhat.com/errata/RHSA-2019:2822 - https://access.redhat.com/errata/RHSA-2019:2836 - https://access.r
/ - https://access.redhat.com/errata/RHSA-2019:2822 - https://access.redhat.com/errata/RHSA-2019:2836 - https://access.redhat.com/errata/RHSA-2019:2885 - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00026.html - http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00024.html
CVE ID: CVE-2019-11502 State: PUBLISHED Published: 2019-04-24T20:02:32 Last Updated: 2024-08-04T22:55:40.662Z Vendors: n/a Products: n/a Problem Types: n/a Description: snap-confine in snapd before 2.38 incorrectly set the ownership of a snap application to the uid and gid of the first calling user. Consequently, that user had unintended access to a private /tmp directory. Additional Analyst Notes: - CVE Program Container: References: - https://www.openwall.com/lists/oss-security/2019/04/18/4 - https://github.com/snapcore/snapd/commit/bdbfeebef03245176ae0dc323392bb0522a339b1 - http://www.openwall.com/lists/oss-security/2019/04/25/7
CVE ID: CVE-2019-11503 State: PUBLISHED Published: 2019-04-24T20:02:44 Last Updated: 2024-08-04T22:55:40.652Z Vendors: n/a Products: n/a Problem Types: n/a Description: snap-confine as included in snapd before 2.39 did not guard against symlink races when performing the chdir() to the current working directory of the calling user, aka a "cwd restore permission bypass." Additional Analyst Notes: - CVE Program Container: References: - https://www.openwall.com/lists/oss-security/2019/04/18/4 - https://github.com/snapcore/snapd/pull/6642 - http://www.openwall.com/lists/oss-security/2019/04/25/7 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6VA
rity/2019/04/25/7 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6VACEKVQ7UAZ32WO4ZKCFW6YOBSYJ76L/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VPU6APEZHAA7N2AI57OT4J2P7NKHFOLM/
CVE ID: CVE-2019-11504 State: PUBLISHED Published: 2019-04-24T20:17:35 Last Updated: 2024-08-04T22:55:40.747Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zotonic before version 0.47 has mod_admin XSS. Additional Analyst Notes: - CVE Program Container: References: - http://docs.zotonic.com/en/latest/developer-guide/releasenotes/rel_0.47.0.html - https://www.exploit-db.com/exploits/46788/ - http://packetstormsecurity.com/files/152717/Zotonic-0.46-mod_admin-Cross-Site-Scripting.html
CVE ID: CVE-2019-11505 State: PUBLISHED Published: 2019-04-24T20:31:00 Last Updated: 2024-08-04T22:55:40.251Z Vendors: n/a Products: n/a Problem Types: n/a Description: In GraphicsMagick from version 1.3.8 to 1.4 snapshot-20190403 Q8, there is a heap-based buffer overflow in the function WritePDBImage of coders/pdb.c, which allows an attacker to cause a denial of service or possibly have unspecified other impact via a crafted image file. This is related to MagickBitStreamMSBWrite in magick/bit_stream.c. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/graphicsmagick/bugs/605/ - http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/85f5bdcd246a - http://
//sourceforge.net/p/graphicsmagick/bugs/605/ - http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/85f5bdcd246a - http://www.securityfocus.com/bid/108063 - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00021.html - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00020.html - https://lists.debian.org/debian-lts-announce/2019/05/msg00027.html - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00055.html - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00057.html - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00001.html - https://usn.ubuntu.com/4207-1/ - https://www.debian.org/security/2020/dsa-4640
CVE ID: CVE-2019-11506 State: PUBLISHED Published: 2019-04-24T20:31:13 Last Updated: 2024-08-04T22:55:40.516Z Vendors: n/a Products: n/a Problem Types: n/a Description: In GraphicsMagick from version 1.3.30 to 1.4 snapshot-20190403 Q8, there is a heap-based buffer overflow in the function WriteMATLABImage of coders/mat.c, which allows an attacker to cause a denial of service or possibly have unspecified other impact via a crafted image file. This is related to ExportRedQuantumType in magick/export.c. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/graphicsmagick/bugs/604/ - http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/57ac0ae85e2a - http://lis
ourceforge.net/p/graphicsmagick/bugs/604/ - http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/57ac0ae85e2a - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00021.html - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00020.html - https://lists.debian.org/debian-lts-announce/2019/05/msg00027.html - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00055.html - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00057.html - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00001.html - https://usn.ubuntu.com/4207-1/ - https://www.debian.org/security/2020/dsa-4640
CVE ID: CVE-2019-11507 State: PUBLISHED Published: 2019-05-08T16:52:15 Last Updated: 2024-08-04T22:55:40.456Z Severity: MEDIUM (CVSS 5.8 CVSS:3.0/AC:H/AV:N/A:L/C:L/I:L/PR:N/S:C/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: In Pulse Secure Pulse Connect Secure (PCS) 8.3.x before 8.3R7.1 and 9.0.x before 9.0R3, an XSS issue has been found on the Application Launcher page. Additional Analyst Notes: - CVE Program Container: References: - https://kb.pulsesecure.net/?atype=sa - https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101/ - http://www.securityfocus.com/bid/108073 - https://i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-N
securityfocus.com/bid/108073 - https://i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-NSA.pdf - https://devco.re/blog/2019/09/02/attacking-ssl-vpn-part-3-the-golden-Pulse-Secure-ssl-vpn-rce-chain-with-Twitter-as-case-study/ - https://www.kb.cert.org/vuls/id/927237 - https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44516
CVE ID: CVE-2019-11508 State: PUBLISHED Published: 2019-05-08T16:49:51 Last Updated: 2024-08-04T22:55:40.588Z Severity: HIGH (CVSS 8.6 CVSS:3.0/AC:L/AV:N/A:N/C:H/I:N/PR:N/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: In Pulse Secure Pulse Connect Secure (PCS) before 8.1R15.1, 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an authenticated attacker (via the admin web interface) can exploit Directory Traversal to execute arbitrary code on the appliance. Additional Analyst Notes: - CVE Program Container: References: - https://kb.pulsesecure.net/?atype=sa - https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101/ - http://www.securityfocus.c
cure.net/?atype=sa - https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101/ - http://www.securityfocus.com/bid/108073 - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010 - https://i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-NSA.pdf - https://devco.re/blog/2019/09/02/attacking-ssl-vpn-part-3-the-golden-Pulse-Secure-ssl-vpn-rce-chain-with-Twitter-as-case-study/ - https://www.kb.cert.org/vuls/id/927237
CVE ID: CVE-2019-11509 State: PUBLISHED Published: 2019-06-03T19:34:46 Last Updated: 2024-08-04T22:55:40.698Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Pulse Secure Pulse Connect Secure (PCS) before 8.1R15.1, 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4 and Pulse Policy Secure (PPS) before 5.1R15.1, 5.2 before 5.2R12.1, 5.3 before 5.3R15.1, 5.4 before 5.4R7.1, and 9.0 before 9.0R3.2, an authenticated attacker (via the admin web interface) can exploit Incorrect Access Control to execute arbitrary code on the appliance. Additional Analyst Notes: - CVE Program Container: References: - https://kb.pulsesecure.net/?atype=sa - https://kb.pulsesecure.net/articl
t Notes: - CVE Program Container: References: - https://kb.pulsesecure.net/?atype=sa - https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101/ - https://www.kb.cert.org/vuls/id/927237
CVE ID: CVE-2019-11510 State: PUBLISHED Published: 2019-05-08T16:18:28.000Z Last Updated: 2025-10-21T23:45:37.755Z Severity: CRITICAL (CVSS 9.9 CVSS:3.0/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthenticated remote attacker can send a specially crafted URI to perform an arbitrary file reading vulnerability . Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://kb.pulsesecure.net/?atype=sa - https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101/ - http://www.securityf
ulsesecure.net/?atype=sa - https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101/ - http://www.securityfocus.com/bid/108073 - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010 - http://packetstormsecurity.com/files/154176/Pulse-Secure-SSL-VPN-8.1R15.1-8.2-8.3-9.0-Arbitrary-File-Disclosure.html - https://badpackets.net/over-14500-pulse-secure-vpn-endpoints-vulnerable-to-cve-2019-11510/ - http://packetstormsecurity.com/files/154231/Pulse-Secure-SSL-VPN-File-Disclosure-NSE.html - https://i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-NSA.pdf - https://devco.re/blog/2019/09/02/attacking-ssl-vpn-part-3-the-golden-Pulse-Secure-ssl-vpn-
orate-Intranet-Like-NSA.pdf - https://devco.re/blog/2019/09/02/attacking-ssl-vpn-part-3-the-golden-Pulse-Secure-ssl-vpn-rce-chain-with-Twitter-as-case-study/ - https://lists.apache.org/thread.html/ff5fa1837b6bd1b24d18a42faa75e165a4573dbe2d434910c15fd08a%40%3Cuser.guacamole.apache.org%3E - https://www.kb.cert.org/vuls/id/927237
CVE ID: CVE-2019-11511 State: PUBLISHED Published: 2019-04-25T02:38:33 Last Updated: 2024-08-04T22:55:40.725Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine ADSelfService Plus before build 5708 has XSS via the mobile app API. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/products/self-service-password/release-notes.html#5708 - https://zeroauth.ltd/blog/2019/05/26/cve-2019-11511-zoho-manageengine-adselfservice-plus-xss/
CVE ID: CVE-2019-11512 State: PUBLISHED Published: 2019-07-09T20:33:49 Last Updated: 2024-08-04T22:55:40.710Z Vendors: n/a Products: n/a Problem Types: n/a Description: Contao 4.x allows SQL Injection. Fixed in Contao 4.4.39 and Contao 4.7.5. Additional Analyst Notes: - CVE Program Container: References: - https://contao.org/en/news/security-vulnerability-cve-2019-11512.html
CVE ID: CVE-2019-11513 State: PUBLISHED Published: 2019-04-25T02:52:28 Last Updated: 2024-08-04T22:55:40.576Z Vendors: n/a Products: n/a Problem Types: n/a Description: The File Manager in CMS Made Simple through 2.2.10 has Reflected XSS via the "New name" field in a Rename action. Additional Analyst Notes: - CVE Program Container: References: - http://dev.cmsmadesimple.org/bug/view/12022
CVE ID: CVE-2019-11514 State: PUBLISHED Published: 2019-04-25T02:59:15 Last Updated: 2024-08-04T22:55:40.533Z Vendors: n/a Products: n/a Problem Types: n/a Description: User/Command/ConfirmEmailHandler.php in Flarum before 0.1.0-beta.8 mishandles invalidation of user email tokens. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/flarum/core/commit/66607a56749339d50620b049701ad4d6a4dafbd7 - https://discuss.flarum.org/d/17745-flarum-0-1-0-beta-8-released
CVE ID: CVE-2019-11515 State: PUBLISHED Published: 2019-04-25T03:05:37 Last Updated: 2024-08-04T22:55:40.596Z Vendors: n/a Products: n/a Problem Types: n/a Description: core/classes/db_backup.php in Gila CMS 1.10.1 allows admin/db_backup?download= absolute path traversal to read arbitrary files. Additional Analyst Notes: - CVE Program Container: References: - https://cisk123456.blogspot.com/2019/04/gila-cms-1101.html