Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
es: - https://research.loginsoft.com/bugs/invalid-memory-access-in-adv_png_unfilter_8-advancecomp/ - https://sourceforge.net/p/advancemame/bugs/272/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J23C6QSTJMQ467KAI6QG54AE4MZRLPQV/ - https://access.redhat.com/errata/RHSA-2019:2332 - https://lists.debian.org/debian-lts-announce/2021/12/msg00034.html
CVE ID: CVE-2019-8385 State: PUBLISHED Published: 2019-06-05T18:35:54 Last Updated: 2024-08-04T21:17:31.327Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Thomson Reuters Desktop Extensions 1.9.0.358. An unauthenticated directory traversal and local file inclusion vulnerability in the ThomsonReuters.Desktop.Service.exe and ThomsonReuters.Desktop.exe allows a remote attacker to list or enumerate sensitive contents of files via a \.. to port 6677. Additionally, this could allow for privilege escalation by dumping the affected machine's SAM and SYSTEM database files, as well as remote code execution. Additional Analyst Notes: - CVE Program Container: Refe
SAM and SYSTEM database files, as well as remote code execution. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/152298/Thomson-Reuters-Concourse-And-Firm-Central-Local-File-Inclusion-Directory-Traversal.html - https://www.thomsonreuters.com/en/products-services.html
CVE ID: CVE-2019-8387 State: PUBLISHED Published: 2019-05-08T13:17:10 Last Updated: 2024-08-04T21:17:31.551Z Vendors: n/a Products: n/a Problem Types: n/a Description: MASTER IPCAMERA01 3.3.4.2103 devices allow Remote Command Execution, related to the thttpd component. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/151725/Master-IP-CAM-01-3.3.4.2103-Remote-Command-Execution.html - https://www.exploit-db.com/exploits/46400/ - https://syrion.me/blog/
CVE ID: CVE-2019-8389 State: PUBLISHED Published: 2019-02-17T03:00:00 Last Updated: 2024-08-04T21:17:31.537Z Vendors: n/a Products: n/a Problem Types: n/a Description: A file-read vulnerability was identified in the Wi-Fi transfer feature of Musicloud 1.6. By default, the application runs a transfer service on port 8080, accessible by everyone on the same Wi-Fi network. An attacker can send the POST parameters downfiles and cur-folder (with a crafted ../ payload) to the download.script endpoint. This will create a MusicPlayerArchive.zip archive that is publicly accessible and includes the content of any requested file (such as the /etc/passwd file). Additional Analyst Notes: - CVE Program Co
nd includes the content of any requested file (such as the /etc/passwd file). Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/shawarkhanethicalhacker/b98c5ac7491cf77732c793ecc468f465
CVE ID: CVE-2019-8390 State: PUBLISHED Published: 2019-05-14T14:57:51 Last Updated: 2024-08-04T21:17:31.429Z Vendors: n/a Products: n/a Problem Types: n/a Description: qdPM 9.1 suffers from Cross-site Scripting (XSS) in the search[keywords] parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/151723/qdPM-9.1-Cross-Site-Scripting.html - https://www.exploit-db.com/exploits/46399/ - http://sourceforge.net/projects/qdpm - http://qdpm.net/download-qdpm-free-project-management
CVE ID: CVE-2019-8391 State: PUBLISHED Published: 2019-05-14T15:05:54 Last Updated: 2024-08-04T21:17:31.395Z Vendors: n/a Products: n/a Problem Types: n/a Description: qdPM 9.1 suffers from Cross-site Scripting (XSS) via configuration?type=[XSS] parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/151723/qdPM-9.1-Cross-Site-Scripting.html - https://www.exploit-db.com/exploits/46398/ - http://sourceforge.net/projects/qdpm - http://qdpm.net/download-qdpm-free-project-management
CVE ID: CVE-2019-8392 State: PUBLISHED Published: 2019-02-17T04:00:00 Last Updated: 2024-08-04T21:17:31.403Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DIR-823G devices with firmware 1.02B03. There is incorrect access control allowing remote attackers to enable Guest Wi-Fi via the SetWLanRadioSettings HNAP API to the web service provided by /bin/goahead. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/leonW7/D-Link/blob/master/Vul_6.md
CVE ID: CVE-2019-8393 State: PUBLISHED Published: 2019-02-17T15:00:00 Last Updated: 2024-08-04T21:17:31.397Z Vendors: n/a Products: n/a Problem Types: n/a Description: Hotels_Server through 2018-11-05 has SQL Injection via the API because the controller/api/login.php telephone parameter is mishandled. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FantasticLBP/Hotels_Server/issues/4
CVE ID: CVE-2019-8394 State: PUBLISHED Published: 2019-02-17T04:00:00.000Z Last Updated: 2025-10-21T23:45:43.349Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows remote attackers to upload arbitrary files via login page customization. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.exploit-db.com/exploits/46413/ - http://www.securityfocus.com/bid/107129 - https://www.manageengine.com/products/service-desk/readme.html
CVE ID: CVE-2019-8395 State: PUBLISHED Published: 2019-02-17T04:00:00 Last Updated: 2024-08-04T21:17:31.250Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Insecure Direct Object Reference (IDOR) vulnerability exists in Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10007 via an attachment to a request. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/products/service-desk/readme.html
CVE ID: CVE-2019-8396 State: PUBLISHED Published: 2019-02-17T06:00:00 Last Updated: 2024-08-04T21:17:31.427Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer overflow in H5O__layout_encode in H5Olayout.c in the HDF HDF5 through 1.10.4 library allows attackers to cause a denial of service via a crafted HDF5 file. This issue was triggered while repacking an HDF5 file, aka "Invalid write of size 2." Additional Analyst Notes: - CVE Program Container: References: - https://github.com/magicSwordsMan/PAAFS/tree/master/vul4
CVE ID: CVE-2019-8397 State: PUBLISHED Published: 2019-02-17T06:00:00 Last Updated: 2024-08-04T21:17:31.583Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the HDF HDF5 1.10.4 library. There is an out of bounds read in the function H5T_close_real in H5T.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/magicSwordsMan/PAAFS/tree/master/vul5
CVE ID: CVE-2019-8398 State: PUBLISHED Published: 2019-02-17T06:00:00 Last Updated: 2024-08-04T21:17:31.569Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the HDF HDF5 1.10.4 library. There is an out of bounds read in the function H5T_get_size in H5T.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/magicSwordsMan/PAAFS/tree/master/vul6
CVE ID: CVE-2019-8400 State: PUBLISHED Published: 2019-02-17T06:00:00 Last Updated: 2024-08-04T21:17:31.580Z Vendors: n/a Products: n/a Problem Types: n/a Description: ORY Hydra before v1.0.0-rc.3+oryOS.9 has Reflected XSS via the oauth2/fallbacks/error error_hint parameter. Additional Analyst Notes: - CVE Program Container: References: - https://drive.google.com/file/d/1-25expUYVfK6vsiCmEabUCuelOP7aUDj/view?usp=drivesdk - https://www.youtube.com/watch?v=RIyZLeKEC8E - https://github.com/ory/hydra/blob/master/CHANGELOG.md#v100-rc3oryos9-2018-12-06 - https://hackerone.com/reports/456333 - https://github.com/ory/hydra/commit/9b5bbd48a72096930af08402c5e07fce7dd770f3
CVE ID: CVE-2019-8401 State: REJECTED Published: 2020-03-04T13:59:36 Last Updated: 2020-03-04T13:59:36 Description: No description available.
CVE ID: CVE-2019-8404 State: PUBLISHED Published: 2019-05-14T15:29:31 Last Updated: 2024-08-04T21:17:31.725Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Webiness Inventory 2.3. The ProductModel component allows Arbitrary File Upload via a crafted product image during the creation of a new product. Consequently, an attacker can steal information from the site with the help of an installed executable file, or change the contents of pages. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/151763/Webiness-Inventory-2.3-Arbitrary-File-Upload.html - https://www.exploit-db.com/exploits/46405/ - https://sou
iles/151763/Webiness-Inventory-2.3-Arbitrary-File-Upload.html - https://www.exploit-db.com/exploits/46405/ - https://sourceforge.net/projects/webinessinventory/files/
CVE ID: CVE-2019-8407 State: PUBLISHED Published: 2019-02-17T18:00:00 Last Updated: 2024-08-04T21:17:31.443Z Vendors: n/a Products: n/a Problem Types: n/a Description: HongCMS 3.0.0 allows arbitrary file read and write operations via a ../ in the filename parameter to the admin/index.php/language/edit URI. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Neeke/HongCMS/issues/7
CVE ID: CVE-2019-8408 State: PUBLISHED Published: 2019-02-17T18:00:00 Last Updated: 2024-08-04T21:17:31.416Z Vendors: n/a Products: n/a Problem Types: n/a Description: OneFileCMS 3.6.13 allows remote attackers to modify onefilecms.php by clicking the Copy button twice. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Self-Evident/OneFileCMS/issues/51
CVE ID: CVE-2019-8410 State: PUBLISHED Published: 2019-02-27T17:00:00 Last Updated: 2024-08-04T21:17:31.436Z Vendors: n/a Products: n/a Problem Types: n/a Description: Maccms 8.0 allows XSS via the inc/config/cache.php t_key parameter because template/paody/html/vod_type.html mishandles the keywords parameter, and a/tpl/module/db.php only filters the t_name parameter (not t_key). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/holychang/maccms8/blob/master/xss2
CVE ID: CVE-2019-8411 State: PUBLISHED Published: 2019-02-17T19:00:00 Last Updated: 2024-08-04T21:17:31.322Z Vendors: n/a Products: n/a Problem Types: n/a Description: admin/dl_data.php in zzcms 2018 (2018-10-19) allows remote attackers to delete arbitrary files via action=del&filename=../ directory traversal. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/615/VulnPoC/issues/1
CVE ID: CVE-2019-8412 State: PUBLISHED Published: 2019-02-17T19:00:00 Last Updated: 2024-08-04T21:17:31.550Z Vendors: n/a Products: n/a Problem Types: n/a Description: FeiFeiCms 4.0.181010 on Windows allows remote attackers to read or delete arbitrary files via index.php?s=Admin-Data-Down-id-..\ or index.php?s=Admin-Data-Del-id-..\ directory traversal. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/615/cms_vuln/blob/master/feifei.docx
CVE ID: CVE-2019-8413 State: PUBLISHED Published: 2019-02-17T19:00:00 Last Updated: 2024-08-04T21:17:31.438Z Vendors: n/a Products: n/a Problem Types: n/a Description: On Xiaomi MIX 2 devices with the 4.4.78 kernel, a NULL pointer dereference in the ioctl interface of the device file /dev/elliptic1 or /dev/elliptic0 causes a system crash via IOCTL 0x4008c575 (aka decimal 1074316661). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/datadancer/HIAFuzz/blob/master/MIX2_elliptic.md
CVE ID: CVE-2019-8418 State: PUBLISHED Published: 2019-02-17T21:00:00 Last Updated: 2024-08-04T21:17:31.730Z Vendors: n/a Products: n/a Problem Types: n/a Description: SeaCMS 7.2 mishandles member.php?mod=repsw4 requests. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/seacms/seacms-v7.2/issues/2
CVE ID: CVE-2019-8419 State: PUBLISHED Published: 2019-02-17T22:00:00 Last Updated: 2024-08-04T21:17:31.823Z Vendors: n/a Products: n/a Problem Types: n/a Description: VNote 2.2 has XSS via a new text note. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tamlok/vnote/issues/564
CVE ID: CVE-2019-8421 State: PUBLISHED Published: 2019-02-17T22:00:00 Last Updated: 2024-08-04T21:17:31.386Z Vendors: n/a Products: n/a Problem Types: n/a Description: upload/protected/modules/admini/views/post/index.php in BageCMS through 3.1.4 allows SQL Injection via the title or titleAlias parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bagesoft/bagecms/issues/5
CVE ID: CVE-2019-8422 State: PUBLISHED Published: 2019-02-17T22:00:00 Last Updated: 2024-08-04T21:17:31.729Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection vulnerability exists in PbootCMS v1.3.2 via the description parameter in apps\admin\controller\content\ContentController.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wowwooo/vnotes/blob/master/PbootCMS%20SQL%20Injection%20Description.md
CVE ID: CVE-2019-8423 State: PUBLISHED Published: 2019-02-18T00:00:00Z Last Updated: 2024-09-17T04:08:57.994Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZoneMinder through 1.32.3 has SQL Injection via the skins/classic/views/events.php filter[Query][terms][0][cnj] parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/LoRexxar/CVE_Request/tree/master/zoneminder%20vul%20before%20v1.32.3#skinsclassicviewseventsphp-line-44-sql-injection - https://www.seebug.org/vuldb/ssvid-97761
CVE ID: CVE-2019-8424 State: PUBLISHED Published: 2019-02-18T00:00:00Z Last Updated: 2024-09-16T22:46:15.953Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZoneMinder before 1.32.3 has SQL Injection via the ajax/status.php sort parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/LoRexxar/CVE_Request/tree/master/zoneminder%20vul%20before%20v1.32.3#ajaxstatusphp-line-276-orderby-sql-injection - https://www.seebug.org/vuldb/ssvid-97763
CVE ID: CVE-2019-8425 State: PUBLISHED Published: 2019-02-18T00:00:00Z Last Updated: 2024-09-16T16:23:59.291Z Vendors: n/a Products: n/a Problem Types: n/a Description: includes/database.php in ZoneMinder before 1.32.3 has XSS in the construction of SQL-ERR messages. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/LoRexxar/CVE_Request/tree/master/zoneminder%20vul%20before%20v1.32.3#sql-query-error-reflected-xss - https://www.seebug.org/vuldb/ssvid-97764
CVE ID: CVE-2019-8426 State: PUBLISHED Published: 2019-02-18T00:00:00Z Last Updated: 2024-09-16T19:14:29.330Z Vendors: n/a Products: n/a Problem Types: n/a Description: skins/classic/views/controlcap.php in ZoneMinder before 1.32.3 has XSS via the newControl array, as demonstrated by the newControl[MinTiltRange] parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/LoRexxar/CVE_Request/tree/master/zoneminder%20vul%20before%20v1.32.3#skinsclassicviewscontrolcapphp-reflected-xss - https://www.seebug.org/vuldb/ssvid-97766
CVE ID: CVE-2019-8427 State: PUBLISHED Published: 2019-02-18T00:00:00Z Last Updated: 2024-09-16T18:29:36.071Z Vendors: n/a Products: n/a Problem Types: n/a Description: daemonControl in includes/functions.php in ZoneMinder before 1.32.3 allows command injection via shell metacharacters. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/LoRexxar/CVE_Request/tree/master/zoneminder%20vul%20before%20v1.32.3#includesfunctionsphp-daemoncontrol-command-injection
CVE ID: CVE-2019-8428 State: PUBLISHED Published: 2019-02-18T00:00:00Z Last Updated: 2024-09-17T00:45:42.160Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZoneMinder before 1.32.3 has SQL Injection via the skins/classic/views/control.php groupSql parameter, as demonstrated by a newGroup[MonitorIds][] value. Additional Analyst Notes: - CVE Program Container: References: - https://www.seebug.org/vuldb/ssvid-97765 - https://github.com/LoRexxar/CVE_Request/tree/master/zoneminder%20vul%20before%20v1.32.3#skinsclassicviewscontrolphp-line-35-second-order-sqli
CVE ID: CVE-2019-8429 State: PUBLISHED Published: 2019-02-18T00:00:00Z Last Updated: 2024-09-16T20:31:57.354Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZoneMinder before 1.32.3 has SQL Injection via the ajax/status.php filter[Query][terms][0][cnj] parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.seebug.org/vuldb/ssvid-97762 - https://github.com/LoRexxar/CVE_Request/tree/master/zoneminder%20vul%20before%20v1.32.3#ajaxstatusphp-line-393-sql-injection
CVE ID: CVE-2019-8432 State: PUBLISHED Published: 2019-02-18T00:00:00Z Last Updated: 2024-09-17T02:02:16.413Z Vendors: n/a Products: n/a Problem Types: n/a Description: In CmsEasy 7.0, there is XSS via the ckplayer.php url parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fakerrr/CmsEasy_7.0/issues/1
CVE ID: CVE-2019-8433 State: PUBLISHED Published: 2019-02-18T00:00:00Z Last Updated: 2024-09-16T20:12:35.286Z Vendors: n/a Products: n/a Problem Types: n/a Description: JTBC(PHP) 3.0.1.8 allows Arbitrary File Upload via the console/#/console/file/manage.php?type=list URI, as demonstrated by a .php file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jetiben/jtbc/issues/6
CVE ID: CVE-2019-8434 State: PUBLISHED Published: 2019-02-18T00:00:00Z Last Updated: 2024-09-16T17:44:08.207Z Vendors: n/a Products: n/a Problem Types: n/a Description: In CmsEasy 7.0, there is XSS via the ckplayer.php autoplay parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fakerrr/CmsEasy_7.0/issues/2
CVE ID: CVE-2019-8435 State: PUBLISHED Published: 2019-02-18T00:00:00Z Last Updated: 2024-09-16T22:20:58.868Z Vendors: n/a Products: n/a Problem Types: n/a Description: admin/default.php in PHPMyWind v5.5 has XSS via an HTTP Host header. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gaozhifeng/PHPMyWind/issues/3
CVE ID: CVE-2019-8436 State: PUBLISHED Published: 2019-02-18T00:00:00Z Last Updated: 2024-09-16T19:04:10.029Z Vendors: n/a Products: n/a Problem Types: n/a Description: imcat 4.5 has Stored XSS via the root/run/adm.php fm[instop][note] parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/peacexie/imcat/issues/1
CVE ID: CVE-2019-8437 State: PUBLISHED Published: 2019-03-07T22:00:00 Last Updated: 2024-08-04T21:17:31.431Z Vendors: n/a Products: n/a Problem Types: n/a Description: njiandan-cms through 2013-05-23 has index.php/admin/user_new CSRF to add an administrator. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/beyond7176/njiandan-cms/issues/1
CVE ID: CVE-2019-8438 State: PUBLISHED Published: 2019-03-07T22:00:00 Last Updated: 2024-08-04T21:17:31.730Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in DiliCMS 2.4.0. There is a Stored XSS Vulnerability in the first textbox of "System setting->site setting" of admin/index.php, aka site_name. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/chekun/DiliCMS/issues/61
CVE ID: CVE-2019-8439 State: PUBLISHED Published: 2019-03-07T22:00:00 Last Updated: 2024-08-04T21:17:31.576Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in DiliCMS 2.4.0. There is a Stored XSS Vulnerability in the second textbox of "System setting->site setting" of admin/index.php, aka site_domain. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/chekun/DiliCMS/issues/62
CVE ID: CVE-2019-8440 State: PUBLISHED Published: 2019-03-07T22:00:00 Last Updated: 2024-08-04T21:17:31.576Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in DiliCMS 2.4.0. There is a Stored XSS Vulnerability in the third textbox (aka site logo) of "System setting->site setting" of admin/index.php, aka site_logo. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/chekun/DiliCMS/issues/63
CVE ID: CVE-2019-8442 State: PUBLISHED Published: 2019-05-22T17:39:14.653681Z Last Updated: 2024-09-16T17:58:53.478Z Vendors: Atlassian Products: Jira Problem Types: Information Exposure Description: The CachingResourceDownloadRewriteRule class in Jira before version 7.13.4, and from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 allows remote attackers to access files in the Jira webroot under the META-INF directory via a lax path access check. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-69241 - http://www.securityfocus.com/bid/108460
CVE ID: CVE-2019-8443 State: PUBLISHED Published: 2019-05-22T17:37:11.201035Z Last Updated: 2024-09-17T03:22:37.334Z Vendors: Atlassian Products: Jira Problem Types: Improper Access Control Description: The ViewUpgrades resource in Jira before version 7.13.4, from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 allows remote attackers who have obtained access to administrator's session to access the ViewUpgrades administrative resource without needing to re-authenticate to pass "WebSudo" through an improper access control vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-69240 - http://w
ional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-69240 - http://www.securityfocus.com/bid/108458
CVE ID: CVE-2019-8444 State: PUBLISHED Published: 2019-08-23T13:49:47.797160Z Last Updated: 2024-09-16T16:33:26.240Z Vendors: Atlassian Products: Jira Problem Types: Cross Site Scripting (XSS) Description: The wikirenderer component in Jira before version 7.13.6, and from version 8.0.0 before version 8.3.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in image attribute specification. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-69779 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0833
CVE ID: CVE-2019-8445 State: PUBLISHED Published: 2019-08-23T13:49:47.839424Z Last Updated: 2024-09-17T02:21:53.651Z Vendors: Atlassian Products: Jira Problem Types: CWE-863 Description: Several worklog rest resources in Jira before version 7.13.7, and from version 8.0.0 before version 8.3.2 allow remote attackers to view worklog time information via a missing permissions check. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-69778 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0840
CVE ID: CVE-2019-8446 State: PUBLISHED Published: 2019-08-23T13:49:47.890614Z Last Updated: 2024-09-17T00:01:21.201Z Vendors: Atlassian Products: Jira Problem Types: CWE-863 Description: The /rest/issueNav/1/issueTable resource in Jira before version 8.3.2 allows remote attackers to enumerate usernames via an incorrect authorisation check. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-69777 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0839
CVE ID: CVE-2019-8447 State: PUBLISHED Published: 2019-08-23T13:49:47.940864Z Last Updated: 2024-09-16T21:02:48.300Z Vendors: Atlassian Products: Jira Problem Types: Cross-Site Request Forgery (CSRF) Description: The ServiceExecutor resource in Jira before version 8.3.2 allows remote attackers to trigger the creation of export files via a Cross-site request forgery (CSRF) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-69776