Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
=77249 - https://usn.ubuntu.com/3902-2/ - https://www.debian.org/security/2019/dsa-4398 - https://usn.ubuntu.com/3902-1/ - http://www.securityfocus.com/bid/107156 - https://bugs.php.net/bug.php?id=77242 - https://security.netapp.com/advisory/ntap-20190321-0001/ - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00083.html - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00104.html - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00041.html - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00044.html - https://access.redhat.com/errata/RHSA-2019:2519 - https://access.redhat.com/errata/RHSA-2019:3299
CVE ID: CVE-2019-9021 State: PUBLISHED Published: 2019-02-22T23:00:00 Last Updated: 2024-08-04T21:31:37.497Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A heap-based buffer over-read in PHAR reading functions in the PHAR extension may allow an attacker to read allocated or unallocated memory past the actual data when trying to parse the file name, a different vulnerability than CVE-2018-20783. This is related to phar_detect_phar_fname_ext in ext/phar/phar.c. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3902-2/ - https://www.de
phar.c. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3902-2/ - https://www.debian.org/security/2019/dsa-4398 - https://usn.ubuntu.com/3902-1/ - https://bugs.php.net/bug.php?id=77247 - http://www.securityfocus.com/bid/107156 - http://www.securityfocus.com/bid/106747 - https://security.netapp.com/advisory/ntap-20190321-0001/ - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00083.html - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00104.html - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00041.html - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00044.html - https://access.redhat.
9-06/msg00041.html - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00044.html - https://access.redhat.com/errata/RHSA-2019:2519 - https://access.redhat.com/errata/RHSA-2019:3299
CVE ID: CVE-2019-9022 State: PUBLISHED Published: 2019-02-22T23:00:00 Last Updated: 2024-08-04T21:31:37.646Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in PHP 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.2. dns_get_record misparses a DNS response, which can allow a hostile DNS server to cause PHP to misuse memcpy, leading to read operations going past the buffer allocated for DNS data. This affects php_parserr in ext/standard/dns.c for DNS_CAA and DNS_ANY queries. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2019/dsa-4398 - https://usn.ubuntu.com/3902-1/ - https://bugs.php.net/bug.php?
rences: - https://www.debian.org/security/2019/dsa-4398 - https://usn.ubuntu.com/3902-1/ - https://bugs.php.net/bug.php?id=77369 - https://security.netapp.com/advisory/ntap-20190321-0001/ - https://lists.debian.org/debian-lts-announce/2019/03/msg00043.html - https://usn.ubuntu.com/3922-2/ - https://usn.ubuntu.com/3922-3/ - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00041.html - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00044.html - https://access.redhat.com/errata/RHSA-2019:2519 - https://access.redhat.com/errata/RHSA-2019:3299 - https://www.tenable.com/security/tns-2019-07
CVE ID: CVE-2019-9023 State: PUBLISHED Published: 2019-02-22T23:00:00 Last Updated: 2024-08-04T21:38:45.186Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A number of heap-based buffer over-read instances are present in mbstring regular expression functions when supplied with invalid multibyte data. These occur in ext/mbstring/oniguruma/regcomp.c, ext/mbstring/oniguruma/regexec.c, ext/mbstring/oniguruma/regparse.c, ext/mbstring/oniguruma/enc/unicode.c, and ext/mbstring/oniguruma/src/utf32_be.c when a multibyte regular expression pattern contains invalid multibyte sequenc
and ext/mbstring/oniguruma/src/utf32_be.c when a multibyte regular expression pattern contains invalid multibyte sequences. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3902-2/ - https://bugs.php.net/bug.php?id=77382 - https://bugs.php.net/bug.php?id=77418 - https://www.debian.org/security/2019/dsa-4398 - https://bugs.php.net/bug.php?id=77371 - https://usn.ubuntu.com/3902-1/ - http://www.securityfocus.com/bid/107156 - https://bugs.php.net/bug.php?id=77370 - https://bugs.php.net/bug.php?id=77385 - https://bugs.php.net/bug.php?id=77394 - https://bugs.php.net/bug.php?id=77381 - https://security.netapp.com/advisory/ntap-20190321-0001/ - https://support.
94 - https://bugs.php.net/bug.php?id=77381 - https://security.netapp.com/advisory/ntap-20190321-0001/ - https://support.f5.com/csp/article/K06372014 - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00083.html - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00104.html - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00041.html - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00044.html - https://access.redhat.com/errata/RHSA-2019:2519 - https://access.redhat.com/errata/RHSA-2019:3299
CVE ID: CVE-2019-9024 State: PUBLISHED Published: 2019-02-22T23:00:00 Last Updated: 2024-08-04T21:38:45.149Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. xmlrpc_decode() can allow a hostile XMLRPC server to cause PHP to read memory outside of allocated areas in base64_decode_xmlrpc in ext/xmlrpc/libxmlrpc/base64.c. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3902-2/ - https://www.debian.org/security/2019/dsa-4398 - https://usn.ubuntu.com/3902-1/ - http://www.securityfocus.com/bid/107156 - https://bugs.php.net/bug.php?id=77380
4398 - https://usn.ubuntu.com/3902-1/ - http://www.securityfocus.com/bid/107156 - https://bugs.php.net/bug.php?id=77380 - https://security.netapp.com/advisory/ntap-20190321-0001/ - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00083.html - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00104.html - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00041.html - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00044.html - https://access.redhat.com/errata/RHSA-2019:2519 - https://access.redhat.com/errata/RHSA-2019:3299
CVE ID: CVE-2019-9025 State: PUBLISHED Published: 2019-02-22T23:00:00 Last Updated: 2024-08-04T21:38:45.180Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in PHP 7.3.x before 7.3.1. An invalid multibyte string supplied as an argument to the mb_split() function in ext/mbstring/php_mbregex.c can cause PHP to execute memcpy() with a negative argument, which could read and write past buffers allocated for the data. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.php.net/bug.php?id=77367 - https://security.netapp.com/advisory/ntap-20190321-0001/
CVE ID: CVE-2019-9026 State: PUBLISHED Published: 2019-02-23T12:00:00 Last Updated: 2024-08-04T21:38:45.607Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in libmatio.a in matio (aka MAT File I/O Library) 1.5.13. There is a heap-based buffer overflow in the function InflateVarName() in inflate.c when called from ReadNextCell in mat5.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tbeu/matio/issues/103 - https://github.com/TeamSeri0us/pocs/tree/master/matio
CVE ID: CVE-2019-9027 State: PUBLISHED Published: 2019-02-23T12:00:00 Last Updated: 2024-08-04T21:38:45.588Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in libmatio.a in matio (aka MAT File I/O Library) 1.5.13. There is a heap-based buffer overflow problem in the function ReadNextCell() in mat5.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tbeu/matio/issues/103 - https://github.com/TeamSeri0us/pocs/tree/master/matio
CVE ID: CVE-2019-9028 State: PUBLISHED Published: 2019-02-23T12:00:00 Last Updated: 2024-08-04T21:38:45.561Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in libmatio.a in matio (aka MAT File I/O Library) 1.5.13. There is a stack-based buffer over-read in the function InflateDimensions() in inflate.c when called from ReadNextCell in mat5.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tbeu/matio/issues/103 - https://github.com/TeamSeri0us/pocs/tree/master/matio
CVE ID: CVE-2019-9029 State: PUBLISHED Published: 2019-02-23T12:00:00 Last Updated: 2024-08-04T21:38:45.638Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in libmatio.a in matio (aka MAT File I/O Library) 1.5.13. There is an out-of-bounds read with a SEGV in the function Mat_VarReadNextInfo5() in mat5.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tbeu/matio/issues/103 - https://github.com/TeamSeri0us/pocs/tree/master/matio
CVE ID: CVE-2019-9030 State: PUBLISHED Published: 2019-02-23T12:00:00 Last Updated: 2024-08-04T21:38:46.036Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in libmatio.a in matio (aka MAT File I/O Library) 1.5.13. There is a stack-based buffer over-read in Mat_VarReadNextInfo5() in mat5.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tbeu/matio/issues/103 - https://github.com/TeamSeri0us/pocs/tree/master/matio
CVE ID: CVE-2019-9031 State: PUBLISHED Published: 2019-02-23T12:00:00 Last Updated: 2024-08-04T21:38:45.573Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in libmatio.a in matio (aka MAT File I/O Library) 1.5.13. There is a NULL pointer dereference in the function Mat_VarFree() in mat.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tbeu/matio/issues/103 - https://github.com/TeamSeri0us/pocs/tree/master/matio
CVE ID: CVE-2019-9032 State: PUBLISHED Published: 2019-02-23T12:00:00 Last Updated: 2024-08-04T21:38:45.555Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in libmatio.a in matio (aka MAT File I/O Library) 1.5.13. There is an out-of-bounds write problem causing a SEGV in the function Mat_VarFree() in mat.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tbeu/matio/issues/103 - https://github.com/TeamSeri0us/pocs/tree/master/matio
CVE ID: CVE-2019-9033 State: PUBLISHED Published: 2019-02-23T12:00:00 Last Updated: 2024-08-04T21:38:45.812Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in libmatio.a in matio (aka MAT File I/O Library) 1.5.13. There is a stack-based buffer over-read for the "Rank and Dimension" feature in the function ReadNextCell() in mat5.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tbeu/matio/issues/103 - https://github.com/TeamSeri0us/pocs/tree/master/matio
CVE ID: CVE-2019-9034 State: PUBLISHED Published: 2019-02-23T12:00:00 Last Updated: 2024-08-04T21:38:45.174Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in libmatio.a in matio (aka MAT File I/O Library) 1.5.13. There is a stack-based buffer over-read for a memcpy in the function ReadNextCell() in mat5.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tbeu/matio/issues/103 - https://github.com/TeamSeri0us/pocs/tree/master/matio
CVE ID: CVE-2019-9035 State: PUBLISHED Published: 2019-02-23T12:00:00 Last Updated: 2024-08-04T21:38:45.555Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in libmatio.a in matio (aka MAT File I/O Library) 1.5.13. There is a stack-based buffer over-read in the function ReadNextStructField() in mat5.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tbeu/matio/issues/103 - https://github.com/TeamSeri0us/pocs/tree/master/matio
CVE ID: CVE-2019-9036 State: PUBLISHED Published: 2019-02-23T12:00:00 Last Updated: 2024-08-04T21:38:45.686Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in libmatio.a in matio (aka MAT File I/O Library) 1.5.13. There is a heap-based buffer overflow in the function ReadNextFunctionHandle() in mat5.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tbeu/matio/issues/103 - https://github.com/TeamSeri0us/pocs/tree/master/matio
CVE ID: CVE-2019-9037 State: PUBLISHED Published: 2019-02-23T12:00:00 Last Updated: 2024-08-04T21:38:45.566Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in libmatio.a in matio (aka MAT File I/O Library) 1.5.13. There is a buffer over-read in the function Mat_VarPrint() in mat.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tbeu/matio/issues/103 - https://github.com/TeamSeri0us/pocs/tree/master/matio
CVE ID: CVE-2019-9038 State: PUBLISHED Published: 2019-02-23T12:00:00 Last Updated: 2024-08-04T21:38:45.546Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in libmatio.a in matio (aka MAT File I/O Library) 1.5.13. There is an out-of-bounds read problem with a SEGV in the function ReadNextCell() in mat5.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tbeu/matio/issues/103 - https://github.com/TeamSeri0us/pocs/tree/master/matio
CVE ID: CVE-2019-9039 State: PUBLISHED Published: 2019-06-26T18:55:45 Last Updated: 2024-08-04T21:38:45.151Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Couchbase Sync Gateway 2.1.2, an attacker with access to the Sync Gateway’s public REST API was able to issue additional N1QL statements and extract sensitive data or call arbitrary N1QL functions through the parameters "startkey" and "endkey" on the "_all_docs" endpoint. By issuing nested queries with CPU-intensive operations they may have been able to cause increased resource usage and denial of service conditions. The _all_docs endpoint is not required for Couchbase Mobile replication and external access to this REST end
conditions. The _all_docs endpoint is not required for Couchbase Mobile replication and external access to this REST endpoint has been blocked to mitigate this issue. This issue has been fixed in versions 2.5.0 and 2.1.3. Additional Analyst Notes: - CVE Program Container: References: - https://docs.couchbase.com/sync-gateway/2.5/release-notes.html - https://research.hisolutions.com/2019/06/n1ql-injection-in-couchbase-sync-gateway-cve-2019-9039/ - https://www.couchbase.com/resources/security#SecurityAlerts
CVE ID: CVE-2019-9040 State: PUBLISHED Published: 2019-02-23T18:00:00Z Last Updated: 2024-09-16T22:03:09.797Z Vendors: n/a Products: n/a Problem Types: n/a Description: S-CMS PHP v3.0 has a CSRF vulnerability to add a new admin user via the admin/ajax.php?type=admin&action=add URI, a related issue to CVE-2018-19332. Additional Analyst Notes: - CVE Program Container: References: - http://www.iwantacve.cn/index.php/archives/113/
CVE ID: CVE-2019-9041 State: PUBLISHED Published: 2019-02-23T18:00:00 Last Updated: 2024-08-04T21:38:45.585Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ZZZCMS zzzphp V1.6.1. In the inc/zzz_template.php file, the parserIfLabel() function's filtering is not strict, resulting in PHP code execution, as demonstrated by the if:assert substring. Additional Analyst Notes: - CVE Program Container: References: - http://www.iwantacve.cn/index.php/archives/118/ - https://www.exploit-db.com/exploits/46454/
CVE ID: CVE-2019-9042 State: PUBLISHED Published: 2019-02-23T18:00:00 Last Updated: 2024-11-15T15:17:04.154Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Sitemagic CMS v4.4. In the index.php?SMExt=SMFiles URI, the user can upload a .php file to execute arbitrary code, as demonstrated by 404.php. This can only occur if the administrator neglects to set FileExtensionFilter and there are untrusted user accounts. NOTE: The maintainer states that this is not a vulnerability but a feature used in conjunction with External Modules Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.iwantacve.cn/index.php/archi
l Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.iwantacve.cn/index.php/archives/116/
CVE ID: CVE-2019-9047 State: PUBLISHED Published: 2019-02-23T21:00:00 Last Updated: 2024-08-04T21:38:46.299Z Vendors: n/a Products: n/a Problem Types: n/a Description: GoRose v1.0.4 has SQL Injection when the order_by or group_by parameter can be controlled. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/huzr2018/orderby_SQLi/tree/master/gorose
CVE ID: CVE-2019-9048 State: PUBLISHED Published: 2019-02-23T19:00:00 Last Updated: 2024-08-04T21:38:45.655Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Pluck 4.7.9-dev1. There is a CSRF vulnerability that can delete a theme (aka topic) via a /admin.php?action=theme_delete&var1= URI. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pluck-cms/pluck/issues/69
CVE ID: CVE-2019-9049 State: PUBLISHED Published: 2019-02-23T19:00:00 Last Updated: 2024-08-04T21:38:46.436Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Pluck 4.7.9-dev1. There is a CSRF vulnerability that can delete modules via a /admin.php?action=module_delete&var1= URI. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pluck-cms/pluck/issues/69
CVE ID: CVE-2019-9050 State: PUBLISHED Published: 2019-02-23T19:00:00 Last Updated: 2024-08-04T21:38:45.669Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Pluck 4.7.9-dev1. It allows administrators to execute arbitrary code by using action=installmodule to upload a ZIP archive, which is then extracted and executed. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pluck-cms/pluck/issues/70
CVE ID: CVE-2019-9051 State: PUBLISHED Published: 2019-02-23T19:00:00 Last Updated: 2024-08-04T21:38:45.641Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Pluck 4.7.9-dev1. There is a CSRF vulnerability that can delete articles via a /admin.php?action=deletepage&var1= URI. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pluck-cms/pluck/issues/69
CVE ID: CVE-2019-9052 State: PUBLISHED Published: 2019-02-23T19:00:00 Last Updated: 2024-08-04T21:38:46.378Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Pluck 4.7.9-dev1. There is a CSRF vulnerability that can delete pictures via a /admin.php?action=deleteimage&var1= URI. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pluck-cms/pluck/issues/69
CVE ID: CVE-2019-9053 State: PUBLISHED Published: 2019-03-26T16:15:38.000Z Last Updated: 2025-11-17T19:19:52.125Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve unauthenticated blind time-based SQL injection via the m1_idlist parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum - https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg - https://www.exploit-db.com/exploits/46635/ - http://packetstormsecurity.com/files/152356/CMS-Made-Simple-SQL-Injecti
g - https://www.exploit-db.com/exploits/46635/ - http://packetstormsecurity.com/files/152356/CMS-Made-Simple-SQL-Injection.html - https://github.com/Perseus99999/CVE-2019-9053-working-/blob/main/exploit.py
CVE ID: CVE-2019-9055 State: PUBLISHED Published: 2019-03-26T16:25:59 Last Updated: 2024-08-04T21:38:45.640Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in CMS Made Simple 2.2.8. In the module DesignManager (in the files action.admin_bulk_css.php and action.admin_bulk_template.php), with an unprivileged user with Designer permission, it is possible reach an unserialize call with a crafted value in the m1_allparms parameter, and achieve object injection. Additional Analyst Notes: - CVE Program Container: References: - https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum - https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRi
esimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum - https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg - http://packetstormsecurity.com/files/155322/CMS-Made-Simple-2.2.8-Remote-Code-Execution.html - https://blog.certimetergroup.com/it/articolo/security/CMS_Made_Simple_deserialization_attack_%28CVE-2019-9055%29
CVE ID: CVE-2019-9056 State: PUBLISHED Published: 2019-04-11T19:26:42 Last Updated: 2024-08-04T21:38:46.289Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in CMS Made Simple 2.2.8. In the module FrontEndUsers (in the file class.FrontEndUsersManipulate.php or class.FrontEndUsersManipulator.php), it is possible to reach an unserialize call with an untrusted __FEU__ cookie, and achieve authenticated object injection. Additional Analyst Notes: - CVE Program Container: References: - https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum - https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg
CVE ID: CVE-2019-9057 State: PUBLISHED Published: 2019-03-26T16:34:22 Last Updated: 2024-08-04T21:38:45.678Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in CMS Made Simple 2.2.8. In the module FilePicker, it is possible to reach an unserialize call with an untrusted parameter, and achieve authenticated object injection. Additional Analyst Notes: - CVE Program Container: References: - https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum - https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg
CVE ID: CVE-2019-9058 State: PUBLISHED Published: 2019-03-26T16:40:52 Last Updated: 2024-08-04T21:38:46.356Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in CMS Made Simple 2.2.8. In the administrator page admin/changegroupperm.php, it is possible to send a crafted value in the sel_groups parameter that leads to authenticated object injection. Additional Analyst Notes: - CVE Program Container: References: - https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum - https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg
CVE ID: CVE-2019-9059 State: PUBLISHED Published: 2019-03-26T16:45:38 Last Updated: 2024-08-04T21:38:45.645Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in CMS Made Simple 2.2.8. It is possible, with an administrator account, to achieve command injection by modifying the path of the e-mail executable in Mail Settings, setting "sendmail" in the "Mailer" option, and launching the "Forgot your password" feature. Additional Analyst Notes: - CVE Program Container: References: - https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum - https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg