Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
or administrative users.) Additional Analyst Notes: - CVE Program Container: References: - https://backdropcms.org/security/backdrop-sa-core-2019-010
CVE ID: CVE-2019-14771 State: PUBLISHED Published: 2019-08-08T01:35:48 Last Updated: 2024-08-05T00:26:38.933Z Vendors: n/a Products: n/a Problem Types: n/a Description: Backdrop CMS 1.12.x before 1.12.8 and 1.13.x before 1.13.3 allows the upload of entire-site configuration archives through the user interface or command line. It does not sufficiently check uploaded archives for invalid data, potentially allowing non-configuration scripts to be uploaded to the server. (This attack is mitigated by the attacker needing the "Synchronize, import, and export configuration" permission, a permission that only trusted administrators should be given. Other preventative measures in Backdrop CMS prevent
sion, a permission that only trusted administrators should be given. Other preventative measures in Backdrop CMS prevent the execution of PHP scripts, so another server-side scripting language must be accessible on the server to execute code.) Note: This has been disputed by multiple 3rd parties due to advanced permissions that are needed to exploit. Additional Analyst Notes: - CVE Program Container: References: - https://backdropcms.org/security/backdrop-sa-core-2019-012
CVE ID: CVE-2019-14772 State: PUBLISHED Published: 2019-08-08T12:59:04 Last Updated: 2024-08-05T00:26:38.634Z Vendors: n/a Products: n/a Problem Types: n/a Description: verdaccio before 3.12.0 allows XSS. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/verdaccio/verdaccio/security/advisories/GHSA-78j5-gcmf-vqc8
CVE ID: CVE-2019-14773 State: PUBLISHED Published: 2019-08-08T19:49:04 Last Updated: 2024-08-05T00:26:38.880Z Vendors: n/a Products: n/a Problem Types: n/a Description: admin/includes/class.actions.snippet.php in the "Woody ad snippets" plugin through 2.2.5 for WordPress allows wp-admin/admin-post.php?action=close&post= deletion. Additional Analyst Notes: - CVE Program Container: References: - https://www.pluginvulnerabilities.com/2019/08/01/post-deletion-vulnerability-in-woody-ad-snippets/ - https://wordpress.org/plugins/insert-php/#developers
CVE ID: CVE-2019-14774 State: PUBLISHED Published: 2019-08-08T19:46:38 Last Updated: 2024-08-05T00:26:38.610Z Vendors: n/a Products: n/a Problem Types: n/a Description: The woo-variation-swatches (aka Variation Swatches for WooCommerce) plugin 1.0.61 for WordPress allows XSS via the wp-admin/admin.php?page=woo-variation-swatches-settings tab parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.pluginvulnerabilities.com/2019/07/30/reflected-cross-site-scripting-xss-vulnerability-in-woocommerce-variation-swatches/ - https://wpvulndb.com/vulnerabilities/9855
CVE ID: CVE-2019-14776 State: PUBLISHED Published: 2019-08-29T18:45:48 Last Updated: 2024-08-05T00:26:38.930Z Vendors: n/a Products: n/a Problem Types: n/a Description: A heap-based buffer over-read exists in DemuxInit() in demux/asf/asf.c in VideoLAN VLC media player 3.0.7.1 via a crafted .mkv file. Additional Analyst Notes: - CVE Program Container: References: - http://git.videolan.org/?p=vlc.git&a=search&h=refs/heads/master&st=commit&s=cve-2019 - https://www.debian.org/security/2019/dsa-4504 - https://seclists.org/bugtraq/2019/Aug/36 - https://www.videolan.org/security/sb-vlc308.html - https://security.gentoo.org/glsa/201909-02 - https://usn.ubuntu.com/4131-1/ - http://lists.opensuse.org/
b-vlc308.html - https://security.gentoo.org/glsa/201909-02 - https://usn.ubuntu.com/4131-1/ - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00036.html - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00046.html
CVE ID: CVE-2019-14777 State: PUBLISHED Published: 2019-08-29T18:53:08 Last Updated: 2024-08-05T00:26:39.056Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Control function of demux/mkv/mkv.cpp in VideoLAN VLC media player 3.0.7.1 has a use-after-free. Additional Analyst Notes: - CVE Program Container: References: - http://git.videolan.org/?p=vlc.git&a=search&h=refs/heads/master&st=commit&s=cve-2019 - https://www.debian.org/security/2019/dsa-4504 - https://seclists.org/bugtraq/2019/Aug/36 - https://www.videolan.org/security/sb-vlc308.html - https://security.gentoo.org/glsa/201909-02 - https://usn.ubuntu.com/4131-1/ - http://lists.opensuse.org/opensuse-security-announce/2020-
.gentoo.org/glsa/201909-02 - https://usn.ubuntu.com/4131-1/ - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00036.html - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00046.html
CVE ID: CVE-2019-14778 State: PUBLISHED Published: 2019-08-29T18:47:41 Last Updated: 2024-08-05T00:26:38.642Z Vendors: n/a Products: n/a Problem Types: n/a Description: The mkv::virtual_segment_c::seek method of demux/mkv/virtual_segment.cpp in VideoLAN VLC media player 3.0.7.1 has a use-after-free. Additional Analyst Notes: - CVE Program Container: References: - http://git.videolan.org/?p=vlc.git&a=search&h=refs/heads/master&st=commit&s=cve-2019 - https://www.debian.org/security/2019/dsa-4504 - https://seclists.org/bugtraq/2019/Aug/36 - https://www.videolan.org/security/sb-vlc308.html - https://security.gentoo.org/glsa/201909-02 - https://usn.ubuntu.com/4131-1/ - http://lists.opensuse.org/o
-vlc308.html - https://security.gentoo.org/glsa/201909-02 - https://usn.ubuntu.com/4131-1/ - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00036.html - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00046.html
CVE ID: CVE-2019-14782 State: PUBLISHED Published: 2019-12-17T15:25:33 Last Updated: 2024-08-05T00:26:38.627Z Vendors: n/a Products: n/a Problem Types: n/a Description: CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.856 through 0.9.8.864 allows an attacker to get a victim's session file name from the /tmp directory, and the victim's token value from /usr/local/cwpsrv/logs/access_log, then use them to make a request to extract the victim's password (for the OS and phpMyAdmin) via an attacker account. Additional Analyst Notes: - CVE Program Container: References: - https://centos-webpanel.com/changelog-cwp7 - https://packetstormsecurity.com/files/155676/Control-Web-Panel-0.9.8.864-phpMyA
s://centos-webpanel.com/changelog-cwp7 - https://packetstormsecurity.com/files/155676/Control-Web-Panel-0.9.8.864-phpMyAdmin-Password-Disclosure.html
CVE ID: CVE-2019-14783 State: PUBLISHED Published: 2019-08-08T20:58:47 Last Updated: 2024-08-05T00:26:38.616Z Vendors: n/a Products: n/a Problem Types: n/a Description: On Samsung mobile devices with N(7.x), and O(8.x), P(9.0) software, FotaAgent allows a malicious application to create privileged files. The Samsung ID is SVE-2019-14764. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb - http://seclists.org/fulldisclosure/2019/Sep/33 - http://packetstormsecurity.com/files/154615/Samsung-Mobile-Android-FotaAgent-Arbitrary-File-Creation.html
CVE ID: CVE-2019-14784 State: PUBLISHED Published: 2019-08-15T15:50:00 Last Updated: 2024-08-05T00:26:38.599Z Vendors: n/a Products: n/a Problem Types: n/a Description: The "CP Contact Form with PayPal" plugin before 1.2.98 for WordPress has XSS in CSS edition. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/cp-contact-form-with-paypal/#developers
CVE ID: CVE-2019-14785 State: PUBLISHED Published: 2019-08-09T12:37:50 Last Updated: 2024-08-05T00:26:38.564Z Vendors: n/a Products: n/a Problem Types: n/a Description: The "CP Contact Form with PayPal" plugin before 1.2.99 for WordPress has XSS in the publishing wizard via the wp-admin/admin.php?page=cp_contact_form_paypal.php&pwizard=1 cp_contactformpp_id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/cp-contact-form-with-paypal/#developers - https://www.pluginvulnerabilities.com/2019/06/24/reflected-cross-site-scripting-xss-vulnerability-in-cp-contact-form-with-paypal/
CVE ID: CVE-2019-14786 State: PUBLISHED Published: 2019-08-15T15:47:52 Last Updated: 2024-08-05T00:26:38.932Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Rank Math SEO plugin 1.0.27 for WordPress allows non-admin users to reset the settings via the wp-admin/admin-post.php reset-cmb parameter. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/9375 - https://rankmath.com/changelog/ - https://www.pluginvulnerabilities.com/2019/06/20/authenticated-settings-reset-vulnerability-in-rank-math-seo/
CVE ID: CVE-2019-14787 State: PUBLISHED Published: 2019-08-09T12:21:59 Last Updated: 2024-08-05T00:26:39.021Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Tribulant Newsletters plugin before 4.6.19 for WordPress allows XSS via the wp-admin/admin-ajax.php?action=newsletters_load_new_editor contentarea parameter. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/9447 - https://www.pluginvulnerabilities.com/2019/07/01/reflected-cross-site-scripting-xss-vulnerability-in-newsletters/ - https://wordpress.org/plugins/newsletters-lite/#developers
CVE ID: CVE-2019-14788 State: PUBLISHED Published: 2019-08-15T15:45:22 Last Updated: 2024-08-05T00:26:38.903Z Vendors: n/a Products: n/a Problem Types: n/a Description: wp-admin/admin-ajax.php?action=newsletters_exportmultiple in the Tribulant Newsletters plugin before 4.6.19 for WordPress allows directory traversal with resultant remote PHP code execution via the subscribers[1][1] parameter in conjunction with an exportfile=../ value. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/9447 - https://wordpress.org/plugins/newsletters-lite/#developers - https://www.pluginvulnerabilities.com/2019/07/02/there-is-also-an-authenticated-remote-cod
ewsletters-lite/#developers - https://www.pluginvulnerabilities.com/2019/07/02/there-is-also-an-authenticated-remote-code-execution-rce-vulnerability-in-newsletters/
CVE ID: CVE-2019-14789 State: PUBLISHED Published: 2019-08-15T15:43:05 Last Updated: 2024-08-05T00:26:38.659Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Custom 404 Pro plugin 3.2.8 for WordPress has XSS via the wp-admin/admin.php?page=c4p-main page parameter. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/custom-404-pro/#developers - https://www.pluginvulnerabilities.com/2019/06/25/other-vulnerability-data-sources-miss-that-a-reflected-xss-vulnerability-in-custom-404-pro-hasnt-been-fixed/
CVE ID: CVE-2019-14790 State: PUBLISHED Published: 2019-08-15T14:57:04 Last Updated: 2024-08-05T00:26:38.963Z Vendors: n/a Products: n/a Problem Types: n/a Description: The limb-gallery (aka Limb Gallery) plugin 1.4.0 for WordPress has XSS via the wp-admin/admin-ajax.php?action=grsGalleryAjax&grsAction=shortcode task parameter, Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/limb-gallery/#developers - https://www.pluginvulnerabilities.com/2019/06/26/what-would-hackers-be-interested-in-the-wordpress-plugin-limb-gallery-for/ - https://wpvulndb.com/vulnerabilities/9517
CVE ID: CVE-2019-14791 State: PUBLISHED Published: 2019-08-09T13:32:47 Last Updated: 2024-08-05T00:26:38.703Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Appointment Booking Calendar plugin 1.3.18 for WordPress allows XSS via the wp-admin/admin-post.php editionarea parameter. Additional Analyst Notes: - CVE Program Container: References: - https://wpvulndb.com/vulnerabilities/9426 - https://wordpress.org/plugins/appointment-booking-calendar/#developers - https://www.pluginvulnerabilities.com/2019/07/03/hackers-look-to-be-targeting-the-wordpress-plugin-appointment-booking-calendar-which-is-yet-another-insecure-plugin-from-code-people/
CVE ID: CVE-2019-14792 State: PUBLISHED Published: 2019-08-09T12:14:49 Last Updated: 2024-08-05T00:26:38.815Z Vendors: n/a Products: n/a Problem Types: n/a Description: The WP Google Maps plugin before 7.11.35 for WordPress allows XSS via the wp-admin/ rectangle_name or rectangle_opacity parameter. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/wp-google-maps/#developers - https://wpvulndb.com/vulnerabilities/9442 - https://www.pluginvulnerabilities.com/2019/07/08/recently-closed-wordpress-plugin-with-400000-installs-contains-another-authenticated-persistent-xss-vulnerability/
CVE ID: CVE-2019-14793 State: PUBLISHED Published: 2019-08-09T12:16:23 Last Updated: 2024-08-05T00:26:39.001Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Meta Box plugin before 4.16.3 for WordPress allows file deletion via ajax, with the wp-admin/admin-ajax.php?action=rwmb_delete_file attachment_id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://metabox.io/changelog/ - https://www.pluginvulnerabilities.com/2019/02/01/full-disclosure-of-authenticated-arbitrary-file-deletion-vulnerability-in-wordpress-plugin-with-300000-installs/
CVE ID: CVE-2019-14794 State: PUBLISHED Published: 2019-08-09T13:33:44 Last Updated: 2024-08-05T00:26:38.580Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Meta Box plugin before 4.16.2 for WordPress mishandles the uploading of files to custom folders. Additional Analyst Notes: - CVE Program Container: References: - https://metabox.io/changelog/
CVE ID: CVE-2019-14795 State: PUBLISHED Published: 2019-08-15T14:55:44 Last Updated: 2024-08-05T00:26:39.059Z Vendors: n/a Products: n/a Problem Types: n/a Description: The toggle-the-title (aka Toggle The Title) plugin 1.4 for WordPress has XSS via the wp-admin/admin-ajax.php?action=update_title_options isAutoSaveValveChecked or isDisableAllPagesValveChecked parameter. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/toggle-the-title/#developers - https://www.pluginvulnerabilities.com/2019/05/16/is-this-authenticated-persistent-cross-site-scripting-xss-vulnerability-what-hackers-would-be-interested-in-toggle-the-title-for/ - https://wpvulndb.com
-cross-site-scripting-xss-vulnerability-what-hackers-would-be-interested-in-toggle-the-title-for/ - https://wpvulndb.com/vulnerabilities/9516
CVE ID: CVE-2019-14796 State: PUBLISHED Published: 2019-08-09T13:32:37 Last Updated: 2024-08-05T00:26:38.928Z Vendors: n/a Products: n/a Problem Types: n/a Description: The mq-woocommerce-products-price-bulk-edit (aka Woocommerce Products Price Bulk Edit) plugin 2.0 for WordPress allows XSS via the wp-admin/admin-ajax.php?action=update_options show_products_page_limit parameter. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/mq-woocommerce-products-price-bulk-edit/#developers - https://www.pluginvulnerabilities.com/2019/05/16/is-this-authenticated-persistent-cross-site-scripting-xss-vulnerability-what-hackers-would-be-interested-in-woocommerce-
is-this-authenticated-persistent-cross-site-scripting-xss-vulnerability-what-hackers-would-be-interested-in-woocommerce-products-price-bulk-edit-for/ - https://wpvulndb.com/vulnerabilities/9515
CVE ID: CVE-2019-14797 State: PUBLISHED Published: 2019-08-09T13:30:40 Last Updated: 2024-08-05T00:26:39.041Z Vendors: n/a Products: n/a Problem Types: n/a Description: The 10Web Photo Gallery plugin before 1.5.23 for WordPress has authenticated stored XSS. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/photo-gallery/#developers
CVE ID: CVE-2019-14798 State: PUBLISHED Published: 2019-08-09T13:29:40 Last Updated: 2024-08-05T00:26:39.062Z Vendors: n/a Products: n/a Problem Types: n/a Description: The 10Web Photo Gallery plugin before 1.5.25 for WordPress has Authenticated Local File Inclusion via directory traversal in the wp-admin/admin-ajax.php?action=shortcode_bwg tagtext parameter. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/photo-gallery/#developers - https://www.pluginvulnerabilities.com/2019/05/14/authenticated-local-file-inclusion-lfi-vulnerability-in-photo-gallery-by-10web/ - https://wpvulndb.com/vulnerabilities/9361
CVE ID: CVE-2019-14799 State: PUBLISHED Published: 2019-08-09T12:18:29 Last Updated: 2024-08-05T00:26:38.773Z Vendors: n/a Products: n/a Problem Types: n/a Description: The FV Flowplayer Video Player plugin before 7.3.14.727 for WordPress allows email subscription XSS. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/fv-wordpress-flowplayer/#developers - https://www.pluginvulnerabilities.com/2019/05/15/information-disclosure-vulnerability-in-fv-player-fv-flowplayer-video-player/ - https://wpvulndb.com/vulnerabilities/9278
CVE ID: CVE-2019-14800 State: PUBLISHED Published: 2019-08-15T14:53:42 Last Updated: 2024-08-05T00:26:39.138Z Vendors: n/a Products: n/a Problem Types: n/a Description: The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows guests to obtain the email subscription list in CSV format via the wp-admin/admin-post.php?page=fvplayer&fv-email-export=1 URI. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/fv-wordpress-flowplayer/#developers - https://www.pluginvulnerabilities.com/2019/05/15/information-disclosure-vulnerability-in-fv-player-fv-flowplayer-video-player/
CVE ID: CVE-2019-14801 State: PUBLISHED Published: 2019-08-09T13:22:24 Last Updated: 2024-08-05T00:26:38.796Z Vendors: n/a Products: n/a Problem Types: n/a Description: The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows email subscription SQL injection. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/fv-wordpress-flowplayer/#developers
CVE ID: CVE-2019-14802 State: PUBLISHED Published: 2022-12-26T00:00:00.000Z Last Updated: 2025-04-14T17:23:01.368Z Vendors: n/a Products: n/a Problem Types: n/a Description: HashiCorp Nomad 0.5.0 through 0.9.4 (fixed in 0.9.5) reveals unintended environment variables to the rendering task during template rendering, aka GHSA-6hv3-7c34-4hx8. This applies to nomad/client/allocrunner/taskrunner/template. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.hashicorp.com/blog/category/nomad - https://advisories.gitlab.com/advisory/advgo_github_com_hashicorp_nomad_client_allocrunner_taskrunner_template_GMS_2022_818.html
CVE ID: CVE-2019-14804 State: PUBLISHED Published: 2019-08-09T13:46:01 Last Updated: 2024-08-05T00:26:39.049Z Vendors: n/a Products: n/a Problem Types: n/a Description: studio/polyglot.php?page=etemplates in UNA 10.0.0-RC1 allows XSS via the System Name field under Emails during template editing. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/unaio/una/commits/master/studio - https://pastebin.com/iMfs1BsM - http://packetstormsecurity.com/files/154018/UNA-10.0.0-RC1-Cross-Site-Scripting.html
CVE ID: CVE-2019-14805 State: PUBLISHED Published: 2019-08-09T13:47:37 Last Updated: 2024-08-05T00:26:38.977Z Vendors: n/a Products: n/a Problem Types: n/a Description: studio/builder_menu.php?page=sets in UNA 10.0.0-RC1 allows XSS via the System Name field under Sets during set editing. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/unaio/una/commits/master/studio - https://pastebin.com/BRFQkqLQ
CVE ID: CVE-2019-14806 State: PUBLISHED Published: 2019-08-09T14:29:16 Last Updated: 2024-08-05T00:26:39.060Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pallets Werkzeug before 0.15.3, when used with Docker, has insufficient debugger PIN randomness because Docker containers share the same machine id. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pallets/werkzeug/blob/7fef41b120327d3912fbe12fb64f1951496fcf3e/src/werkzeug/debug/__init__.py#L168 - https://github.com/pallets/werkzeug/commit/00bc43b1672e662e5e3b8cecd79e67fc968fa246 - https://palletsprojects.com/blog/werkzeug-0-15-3-released/ - http://lists.opensuse.org/opensuse-security-announ
8fa246 - https://palletsprojects.com/blog/werkzeug-0-15-3-released/ - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00034.html - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00047.html
CVE ID: CVE-2019-14807 State: PUBLISHED Published: 2019-08-09T20:28:46 Last Updated: 2024-08-05T00:26:38.775Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the MobileFrontend extension 1.31 through 1.33 for MediaWiki, XSS exists within the edit summary field in includes/specials/MobileSpecialPageFeed.php. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T229541 - https://gerrit.wikimedia.org/g/mediawiki/extensions/MobileFrontend/+/08dfc59771d0ed9b739a59bb521baf7f59d169f9
CVE ID: CVE-2019-14808 State: PUBLISHED Published: 2019-10-09T15:03:05 Last Updated: 2024-08-05T00:26:38.963Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the RENPHO application 3.0.0 for iOS. It transmits JSON data unencrypted to a server without an integrity check, if a user changes personal data in his profile tab (e.g., exposure of his birthday) or logs into his account (i.e., exposure of credentials). Additional Analyst Notes: - CVE Program Container: References: - https://apps.apple.com/us/app/renpho/id1219889310 - https://renpho.com/pages/contact-us - http://packetstormsecurity.com/files/154772/RENPHO-3.0.0-Information-Disclosure.html
CVE ID: CVE-2019-14809 State: PUBLISHED Published: 2019-08-13T20:54:24 Last Updated: 2024-08-05T00:26:39.120Z Vendors: n/a Products: n/a Problem Types: n/a Description: net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications. This is related to a Host field with a suffix appearing in neither Hostname() nor Port(), and is related to a non-numeric port number. For example, an attacker can compose a crafted javascript:// URL that results in a hostname of google.com. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/forum/#%21topic/golang-announce/0uuMm1BwpHE - https
es: - CVE Program Container: References: - https://groups.google.com/forum/#%21topic/golang-announce/0uuMm1BwpHE - https://groups.google.com/forum/#%21topic/golang-announce/65QixT3tcmg - https://github.com/golang/go/issues/29098 - https://seclists.org/bugtraq/2019/Aug/31 - https://www.debian.org/security/2019/dsa-4503 - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00076.html - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00002.html - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00011.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LYO6E3H34C346D2E443GLXK7OK6KIYIQ/ - https://lists.
.org/archives/list/package-announce%40lists.fedoraproject.org/message/LYO6E3H34C346D2E443GLXK7OK6KIYIQ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4BBP27PZGSY6OP6D26E5FW4GZKBFHNU7/ - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00021.html - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00038.html - https://access.redhat.com/errata/RHSA-2019:3433
CVE ID: CVE-2019-14810 State: PUBLISHED Published: 2019-10-10T18:07:51 Last Updated: 2024-08-05T00:26:39.049Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability has been found in the implementation of the Label Distribution Protocol (LDP) protocol in EOS. Under race conditions, the LDP agent can establish an LDP session with a malicious peer potentially allowing the possibility of a Denial of Service (DoS) attack on route updates and in turn potentially leading to an Out of Memory (OOM) condition that is disruptive to traffic forwarding. Affected EOS versions include: 4.22 release train: 4.22.1F and earlier releases 4.21 release train: 4.21.0F - 4.21.2.3F, 4.21.3F - 4